Applications using org.apache.wicket:wicket-core versions 9.1.0 through 9.23.0 or 10.0.0 through 10.10.0 are affected when they rely on the default FetchMetadataResourceIsolationPolicy provided by ResourceIsolationRequestCycleListener.
An attacker needs to cause a victim using an authenticated Wicket application to visit an attacker-controlled page. That page can navigate the victim’s browser to a Wicket listener URL using a cross-site GET navigation.
The issue affects component listeners invoked through ordinary GET navigations, including Link.onClick(), form submissions, and behaviour callbacks. The listener executes in the victim’s authenticated session when the browser sends the relevant session cookies.
The described attack uses a top-level GET navigation. Browsers send SameSite=Lax cookies in that situation, and SameSite=Lax is described as the effective default when no SameSite attribute is configured.