PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-102695 omnifaces CVE debrief

The CVE-2026-102695 vulnerability in OmniFaces allows attackers to forge combined-resource IDs, potentially leading to server-side request forgery, unauthorized resource access, and information disclosure. This issue arises from the lack of authenticity checks on path-derived IDs, which can be inflated without output limits and converted to attacker-selected resource identifiers. Affected versions include those prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, depending on the ecosystem. Users should assess exposure, prioritize remediation, and verify inventory for vulnerable versions.

Vendor
omnifaces
Product
org.omnifaces:omnifaces
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-24
Original CVE updated
2026-10-14
Advisory published
2026-07-24
Advisory updated
2026-10-14

Who should care

Defenders responsible for OmniFaces deployments should assess exposure and prioritize remediation. This includes verifying inventory for vulnerable versions, monitoring for suspicious activity, and applying patches or mitigations as available.

Why it matters

CVE-2026-102695 allows attackers to forge combined-resource IDs in OmniFaces, potentially leading to server-side request forgery, unauthorized resource access, and information disclosure. Defenders should assess exposure, prioritize remediation, and verify inventory for vulnerable versions.

  • Potential for server-side request forgery
  • Unauthorized resource access and information disclosure
  • Need for verification of inventory and exposure
  • Prioritization of remediation and mitigation efforts

Technical summary

The OmniFaces library is vulnerable to combined-resource ID forgery due to a lack of authenticity checks on path-derived IDs. This allows attackers to inflate IDs without output limits, convert them to attacker-selected resource identifiers, and retain unique IDs in an unbounded static cache. Potential impacts include server-side request forgery, unauthorized resource access, and information disclosure.

Defensive priority

Defenders should prioritize verifying inventory for vulnerable OmniFaces versions, assessing exposure to potential attacks, and applying patches or mitigations as available.

Recommended defensive actions

  • Verify inventory for vulnerable OmniFaces versions
  • Assess exposure to potential attacks
  • Apply patches or mitigations as available
  • Monitor for suspicious activity
  • Perform a thorough review of system logs for signs of exploitation
  • Implement additional security measures such as Web Application Firewalls (WAFs)
  • Conduct a thorough risk assessment to identify potential attack vectors

Evidence notes

The source corpus provides details on the vulnerability, including the lack of authenticity checks on combined-resource IDs, potential for inflation and conversion to attacker-selected identifiers, and the existence of affected versions across different ecosystems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-102695 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-102695

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-102695 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102695

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OmniFaces: Forged combined-resource IDs and related output/push boundaries

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/Maven/GHSA-fp43-vj7g-pg92.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces/security/advisories/GHSA-fp43-vj7g-pg92

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces/commit/59d6c5188c39418546fe500d05036645987a77d1

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces/commit/a52b92461cf39d983f51ce8724fe7e6b944073e4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces/commit/aa42da361821ddfbb85b126564e71587347d2786

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces/commit/c43eef01174a4dc09cec44eff553ff6284150af7

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces/commit/d5cae243c4692555efaa4ba774e0f8f60e3f4db5

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/omnifaces/omnifaces

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.