This vulnerability report details several issues in OmniFaces involving forged combined-resource IDs that lack authenticity checks, allowing attackers to inflate resource usage and bypass resource boundaries, including CDN wildcard mappings and inner resource access. The source-map cache grows unboundedly with missing eviction. The o:hashParam component writes unescaped JavaScript payloads into Ajax callbacks, enabling XSS. WebSocket push channels do not bind handshakes to HTTP sessions, allowing replay of victim push messages after token exposure. Push channel idle timeouts are set to zero and sessions accumulate in unbounded queues, causing resource management concerns. The report suggests fixes including authenticating combined IDs, bounding caches, escaping hashParam output, binding push subscriptions to sessions, and adding configurable idle timeouts and channel limits. Affected versions span multiple major releases prior to specific fixed versions.

The forged combined-resource ID vulnerability can cause excessive memory usage and bypass resource access restrictions, potentially exposing raw resource content and causing server-side fetches to attacker-controlled hosts. The unbounded source-map cache can lead to increased memory consumption. The hashParam XSS vulnerability allows injection of arbitrary JavaScript in Ajax callbacks, leading to client-side code execution. The session/view push-channel replay flaw permits an attacker with a victim's channel ID to receive push messages intended for that victim, violating session isolation. The push idle-connection and fanout design can cause resource exhaustion due to unbounded session queues and zero idle timeouts. These impacts can degrade service availability and compromise client security.

No official patch links are provided; patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Suggested mitigations include authenticating combined-resource IDs with a per-deployment secret, limiting inflated output size, bounding or evicting caches including the combined-resource and source-map caches, rejecting attacker-selected inner resources at serve time, deriving dynamic resource origins from trusted configuration rather than untrusted Host headers, applying JavaScript-string and CDATA-safe encoding to hashParam callback values, binding WebSocket push subscriptions to the owning HTTP session or authenticated principal, and configuring finite idle timeouts and per-channel client limits. Operators should monitor vendor advisories for official fixes and apply them when available.