CVE-2026-40010: Apache Wicket has a Session Fixation issue
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Published May 6, 2026 · Updated May 11, 2026
Affected packages
org.apache.wicket:wicket-auth-roles
- Ecosystem
- Maven
- Affected
- >= 8.0.0-M1, <= 8.17.0
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.wicket:wicket-auth-roles
org.apache.wicket:wicket-auth-roles
- Ecosystem
- Maven
- Affected
- >= 9.0.0-M1, <= 9.22.0
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.wicket:wicket-auth-roles
org.apache.wicket:wicket-auth-roles
- Ecosystem
- Maven
- Affected
- >= 10.0.0-M1, <= 10.8.0
- Fixed in
- 10.9.0
- Check
mvn dependency:tree -Dincludes=org.apache.wicket:wicket-auth-roles
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology