Skip to content
Threat Feed
Subscribe
high advisory

Multiple High-Severity Vulnerabilities in OmniFaces Library

Multiple vulnerabilities in OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 allow attackers to exploit forged combined-resource IDs leading to server-side request forgery (SSRF)-like behavior or information disclosure, achieve client-side arbitrary code execution via cross-site scripting (XSS) in `o:hashParam`, bypass session authentication for push channels resulting in unauthorized message interception, and cause denial-of-service (DoS) via unbounded caches.

The OmniFaces project, a utility library for JavaServer Faces (JSF), published an advisory on July 24, 2026, detailing multiple high-severity vulnerabilities affecting various versions (specifically, prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2). These issues include the exploitation of forged combined-resource IDs to bypass security boundaries, potentially leading to information disclosure of internal application resources or enabling server-side request forgery (SSRF)-like behavior through outbound connections. An XSS vulnerability allows client-side script execution due to improper escaping of JavaScript payloads from o:hashParam. Furthermore, session-scoped push channels are vulnerable to replay attacks, allowing unauthorized access to a victim's push messages. The presence of unbounded static caches and per-channel queues also introduces denial-of-service (DoS) risks through resource exhaustion, posing significant threats to data confidentiality, integrity, and availability. These issues are distinct from a prior CVE-2026-41883 fix, originating from unsigned combined IDs, missing decode/cache bounds, and improper input handling.

Attack Chain

  1. Attacker crafts an HTTP request containing a forged CombinedResourceInfo ID or a URL with an unescaped JavaScript payload intended for o:hashParam.
  2. The OmniFaces application processes the request, either accepting the forged ID due to missing authenticity checks or storing the unescaped JavaScript payload.
  3. For forged IDs, the application performs server-side fetches of internal resources (bypassing exclusion rules) or initiates outbound connections to attacker-specified hosts (SSRF-like behavior), potentially disclosing internal information.
  4. For the o:hashParam vulnerability, a victim's browser executes the unescaped JavaScript payload during a subsequent Ajax render, leading to client-side attacks.
  5. An attacker obtains a legitimate session-scoped push channel ID from a victim and reuses it to subscribe to the victim's push notifications, gaining unauthorized access to sensitive real-time data.
  6. Through repeated exploitation of unbounded caches (e.g., combined-resource IDs, source-map cache) or per-channel queues, the attacker causes resource exhaustion on the server, leading to application instability or denial of service for legitimate users.

Impact

The vulnerabilities allow for various severe impacts. Successful exploitation of forged combined-resource IDs can lead to sensitive information disclosure from internal application resources or enable server-side request forgery (SSRF)-like attacks, potentially allowing attackers to scan internal networks or interact with internal services. The cross-site scripting (XSS) vulnerability can result in client-side arbitrary code execution, enabling session hijacking, credential theft, or defacement of web pages for affected users. The session/view push-channel replay vulnerability permits unauthorized interception of real-time push messages intended for specific users, compromising data confidentiality. Additionally, multiple unbounded caches and queues create denial-of-service (DoS) opportunities, allowing attackers to exhaust server memory, CPU, or network resources, leading to application crashes or complete service unavailability.

Recommendation

  • Upgrade OmniFaces to a patched version (1.14.3, 2.7.33, 3.14.23, 4.7.12, or 5.4.2) immediately to mitigate all described vulnerabilities.
  • Monitor web server access logs for unusual request patterns, particularly those involving CombinedResourceInfo paths or o:hashParam with unusual or encoded characters.
  • Implement outbound network traffic monitoring to detect unexpected connections initiated by the application server, which could indicate SSRF-like activity from forged combined-resource IDs.
  • Review application logs for signs of resource exhaustion, such as excessive memory usage or frequent garbage collection events, potentially indicating denial-of-service attempts related to unbounded caches or queues.