GHSA-qpjw-p3jg-59j6: Apache Wicket: possible session fixation using AuthenticatedWebSession

Q: Which deployments are affected?

Apache Wicket versions 8.0.0 through 8.17.0, 9.0.0, and 10.0.0 through 10.8.0 are affected. Version 10.9.0 fixes the issue.

Q: What condition enables exploitation?

The issue is exploitable when an application uses AuthenticatedWebSession and does not change the servlet session ID after session binding. An attacker can exploit this missing session-ID rotation for session fixation.

Q: What should teams do to remediate this issue?

Upgrade Apache Wicket to version 10.9.0. The provided information does not specify an alternative mitigation for deployments that cannot upgrade immediately.

Published May 6, 2026

Updated

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Affected Software

1 affected component

Apache wicket>=8.0.0<=8.17.0, =9.0.0, >=10.0.0<=10.8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Wicket to a version that resolves this vulnerability.
Fixed in 10.9.0

Event History

May 6, 2026

CVE Published

via OSV·08:34 AM

Data Sourced

via OSV·08:34 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are affected?

Apache Wicket versions 8.0.0 through 8.17.0, 9.0.0, and 10.0.0 through 10.8.0 are affected. Version 10.9.0 fixes the issue.

What condition enables exploitation?

The issue is exploitable when an application uses AuthenticatedWebSession and does not change the servlet session ID after session binding. An attacker can exploit this missing session-ID rotation for session fixation.

What should teams do to remediate this issue?

Upgrade Apache Wicket to version 10.9.0. The provided information does not specify an alternative mitigation for deployments that cannot upgrade immediately.

GHSA-qpjw-p3jg-59j6: Apache Wicket: possible session fixation using AuthenticatedWebSession

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What condition enables exploitation?

What should teams do to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What condition enables exploitation?

What should teams do to remediate this issue?