CVE-2026-82115

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 7.0.0 through 8.19.0 Apache Wicket versions 9.0.0 through 9.24.0 Apache Wicket versions 10.0.0 through 10.11.0

Description Apache Wicket contains an authorization bypass in its native WebSocket support. The WebSocketMessageBroadcastHandler request handler delivers incoming frames by resolving the shared resource named in the client's handshake parameter and calling WebSocketResource#onPayload() directly. This process bypasses the IAuthorizationStrategy#isResourceAuthorized() check, meaning the @AuthorizeResource annotation on such classes is ignored. A caller with a valid Wicket session and the resource name can send text or binary messages to restricted callbacks, including onConnect() and onMessage(). This issue affects applications that register a WebSocketResource as a shared resource and rely on the authorization strategy for restriction. This does not grant access to other users' connections.

Recommendations Upgrade Apache Wicket versions 7.0.0 through 8.19.0 to version 8.20.0. Upgrade Apache Wicket versions 9.0.0 through 9.24.0 to version 9.25.0. Upgrade Apache Wicket versions 10.0.0 through 10.11.0 to version 10.12.0. As a temporary workaround, reject unauthorized connections using an IWebSocketConnectionFilter registered via WebSocketSettings#setConnectionFilter() or manually repeat the authorization check at the start of each callback.