Answer in brief
CVE-2021-26296 records a Unknown severity vulnerability in Cryptographically weak CSRF tokens in Apache MyFaces. The current sources do not mark it as known exploited. The current feed maps org.apache.myfaces.core:myfaces-core-module (maven), org.apache.myfaces.core:myfaces-core-module (maven), org.apache.myfaces.core:myfaces-core-module (maven), org.apache.myfaces.core:myfaces-core-module (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps org.apache.myfaces.core:myfaces-core-module (maven), org.apache.myfaces.core:myfaces-core-module (maven), org.apache.myfaces.core:myfaces-core-module (maven), org.apache.myfaces.core:myfaces-core-module (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| org.apache.myfaces.core:myfaces-core-modulemaven | >=0 <2.0.25 | 2.0.25 |
| org.apache.myfaces.core:myfaces-core-modulemaven | >=2.1.0 <2.1.19 | 2.1.19 |
| org.apache.myfaces.core:myfaces-core-modulemaven | >=2.2.0 <2.2.14 | 2.2.14 |
| org.apache.myfaces.core:myfaces-core-modulemaven | >=2.3.0 <2.3.8 | 2.3.8 |
Published upstream
Jun 16, 2021
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application. Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation: org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom
Quoted source text, attributed separately from HOL analysis.