CVE-2026-40010 Apache Wicket: possible session fixation using AuthenticatedWebSession

What is CVE-2026-40010?

CVE-2026-40010 is a critical vulnerability in Apache Wicket, published on 6 May 2026.

Official description

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Weakness: CWE-384

Which versions are affected by CVE-2026-40010?

6 open source packages ship an affected version, including org.apache.wicket:wicket-auth-roles. It affects 1 product.

Products include Apache Wicket.

How do I fix CVE-2026-40010?

Upgrade org.apache.wicket:wicket-auth-roles to 10.9.0 or later.

Is CVE-2026-40010 being exploited?

There is no known exploitation of CVE-2026-40010 in the wild and no public exploit code.

Other vulnerabilities in Apache Wicket

• CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection Critical 9.8
• CVE-2016-6793 Deserialization in n/a Critical 9.1
• CVE-2016-6806 Apache Wicket vulnerable to CSRF attacks High 8.8
• CVE-2026-71257 Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed High 7.5
• CVE-2026-43646 Apache Wicket: crafted URLs can bypass PackageResourceGuard High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qpjw-p3jg-59j6.