https://seclists.org/oss-sec/2026/q3/617: CVE-2026-71378: Apache Wicket: Cross-Site quest Forgery (CSRF) protection bypass in sourceIsolationquestCycleListener

Q: Which deployments are affected?

Applications using org.apache.wicket:wicket-core versions 9.1.0 through 9.23.0 or 10.0.0 through 10.10.0 are affected when they rely on the default FetchMetadataResourceIsolationPolicy provided by ResourceIsolationRequestCycleListener.

Q: What does an attacker need to exploit this issue?

An attacker needs to cause a victim using an authenticated Wicket application to visit an attacker-controlled page. That page can navigate the victim’s browser to a Wicket listener URL using a cross-site GET navigation.

Q: Which application actions can be triggered through the bypass?

The issue affects component listeners invoked through ordinary GET navigations, including Link.onClick(), form submissions, and behaviour callbacks. The listener executes in the victim’s authenticated session when the browser sends the relevant session cookies.

Q: Why can this affect applications using default cookie settings?

The described attack uses a top-level GET navigation. Browsers send SameSite=Lax cookies in that situation, and SameSite=Lax is described as the effective default when no SameSite attribute is configured.

Published Aug 30, 2026

Updated

Affected Software

2 affected components

Apache wicket>=9.1.0<=9.23.0

Apache wicket>=10.0.0<=10.10.0

Frequently Asked Questions

Which deployments are affected?

Applications using org.apache.wicket:wicket-core versions 9.1.0 through 9.23.0 or 10.0.0 through 10.10.0 are affected when they rely on the default FetchMetadataResourceIsolationPolicy provided by ResourceIsolationRequestCycleListener.

What does an attacker need to exploit this issue?

An attacker needs to cause a victim using an authenticated Wicket application to visit an attacker-controlled page. That page can navigate the victim’s browser to a Wicket listener URL using a cross-site GET navigation.

Which application actions can be triggered through the bypass?

The issue affects component listeners invoked through ordinary GET navigations, including Link.onClick(), form submissions, and behaviour callbacks. The listener executes in the victim’s authenticated session when the browser sends the relevant session cookies.

Why can this affect applications using default cookie settings?

The described attack uses a top-level GET navigation. Browsers send SameSite=Lax cookies in that situation, and SameSite=Lax is described as the effective default when no SameSite attribute is configured.