Package · Maven

org.apache.wicket:wicket-auth-roles

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

Critical 9.1

CVE-2026-40010

Apache Wicket: possible session fixation using AuthenticatedWebSession

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users …

Apache Software Foundation Apache Wicket org.apache.wicket:wicket-auth-roles Maven

May 6, 2026