CVE-2026-40010: Apache Wicket: possible session fixation using AuthenticatedWebSession
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40010?
CVE-2026-40010 has a medium severity level, as it allows for session fixation attacks that can compromise user sessions.
How do I fix CVE-2026-40010?
To fix CVE-2026-40010, update Apache Wicket to version 8.18.0 or above, or 10.9.0 or above.
Which versions of Apache Wicket are affected by CVE-2026-40010?
CVE-2026-40010 affects Apache Wicket versions from 8.0.0 to 8.17.0, 9.0.0, and from 10.0.0 to 10.8.0.
What kind of attack does CVE-2026-40010 enable?
CVE-2026-40010 enables session fixation attacks due to missing session ID changes upon user authentication.
Is CVE-2026-40010 a threat to all users of Apache Wicket?
Yes, CVE-2026-40010 poses a threat to all users of the affected versions of Apache Wicket, especially in applications handling sensitive user data.