CVE-2026-82840

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.18.0 through 8.19.0 Apache Wicket versions 9.23.0 through 9.24.0 Apache Wicket versions 10.9.0 through 10.11.0

Description Session fixation exists in the role-based security module. The signIn(String, String) method in the AuthenticatedWebSession class fails to renew the session ID when a session that is already signed in authenticates again. This occurs because the session ID renewal via changeSessionId() is only triggered during the first transition of the signed-in flag. An attacker can exploit this if they can plant a session ID they have already authenticated with into a victim's browser, provided the application allows re-authentication for signed-in users, such as during account switches or step-up prompts for sensitive actions.

Recommendations Upgrade Apache Wicket versions 8.18.0 through 8.19.0 to version 8.20.0. Upgrade Apache Wicket versions 9.23.0 through 9.24.0 to version 9.25.0. Upgrade Apache Wicket versions 10.9.0 through 10.11.0 to version 10.12.0. As a temporary workaround, call the changeSessionId() function at the end of the authenticate(String, String) implementation to manually renew the session ID on every successful authentication.