CVE-2026-71378

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 9.1.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0

Description The ResourceIsolationRequestCycleListener fails to properly protect applications against cross-site request forgery due to unsafe allowances in the FetchMetadataResourceIsolationPolicy. First, it allows all simple top-level navigations where Sec-Fetch-Mode is navigate and Sec-Fetch-Dest is neither object nor embed, regardless of the Sec-Fetch-Site value. This allows an attacker to trigger component listeners, such as Link.onClick(), through cross-site GET navigations. Second, it unconditionally allows requests with Sec-Fetch-Site set to same-site, enabling sibling origins (different subdomains or ports) to invoke listeners via any method, including POST form submits.

Recommendations Upgrade Apache Wicket versions 9.1.0 through 9.23.0 to version 9.24.0. Upgrade Apache Wicket versions 10.0.0 through 10.10.0 to version 10.11.0.