by Kastro
Paper/Archive/CVE-2026-40010

CVE-2026-40010

Apache Software Foundation Apache Wicket — Apache Wicket: possible session fixation using AuthenticatedWebSession

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 31.9.319 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Affected

ProductAffectedFixed inSource
Apache Wicket10.0.0 – 10.8.0–CNA
Apache Wicket8.0.0 – 8.17.0–CNA
Apache Wicket9.0.0 – 9.22.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/61wsc0xdtfd5oozojfx7by9w3jwgkmv1refopenwall.com/lists/oss-security/2026/05/06/1