Andre Kropp

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions 9.1.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 **Description** The `ResourceIsolationRequestCycleListener` fails to properly protect applications against cross-site request forgery due to unsafe allowances in the `FetchMetadataResourceIsolationPolicy`. First, it allows all simple top-level navigations where `Sec-Fetch-Mode` is `navigate` and `Sec-Fetch-Dest` is neither `object` nor `embed`, regardless of the `Sec-Fetch-Site` value. This allows an attacker to trigger component listeners, such as `Link.onClick()`, through cross-site GET navigations. Second, it unconditionally allows requests with `Sec-Fetch-Site` set to `same-site`, enabling sibling origins (different subdomains or ports) to invoke listeners via any method, including POST form submits. **Recommendations** Upgrade Apache Wicket versions 9.1.0 through 9.23.0 to version 9.24.0. Upgrade Apache Wicket versions 10.0.0 through 10.10.0 to version 10.11.0.