{"action":"Upgrade org.apache.myfaces.core:myfaces-core-module to 2.0.25 (2.0.x), 2.1.19 (2.1.x), 2.2.14 (2.2.x) or 2.3.8 (2.3.x) or later.","affected":[{"fixed":"2.0.25","introduced":"0"},{"fixed":"2.1.19","introduced":"2.1.0"},{"fixed":"2.2.14","introduced":"2.2.0"},{"fixed":"2.3.8","introduced":"2.3.0"}],"component":"org.apache.myfaces.core:myfaces-core-module","cve_ids":["CVE-2021-26296"],"ecosystem":"Maven","epss":0.02889,"exploited":false,"fixed_versions":["2.0.25","2.1.19","2.2.14","2.3.8"],"ghsa_id":"GHSA-gq67-pp9w-43gp","id":"tcs_01M5N8YQ533R9JZTS01RWZKHVV","modified_at":"2026-09-10T03:49:06.075401802Z","published_at":"2021-06-16T17:31:39Z","references":["https://osv.dev/vulnerability/GHSA-gq67-pp9w-43gp","https://nvd.nist.gov/vuln/detail/CVE-2021-26296","https://github.com/apache/myfaces/commit/cc6e1cc7b9aa17e52452f7f2657b3af9c421b2b2","https://issues.apache.org/jira/browse/MYFACES-4373","https://lists.apache.org/thread.html/r2b73e2356c6155e9ec78fdd8f72a4fac12f3e588014f5f535106ed9b%40%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20210528-0007","http://packetstormsecurity.com/files/161484/Apache-MyFaces-2.x-Cross-Site-Request-Forgery.html","http://seclists.org/fulldisclosure/2021/Feb/66"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-gq67-pp9w-43gp","url":"https://osv.dev/vulnerability/GHSA-gq67-pp9w-43gp"}],"summary":"Cryptographically weak CSRF tokens in Apache MyFaces"}