https://seclists.org/oss-sec/2026/q4/463: Apache Wicket: 19 CVEs fixed in 8.20.0, 9.25.0 and 10.12.0
Published Nov 1, 2026
·Updated
Affected Software
1 affected component
Apache wicket>=8.0.0<8.20.0, >=9.0.0<9.25.0, >=10.0.0<10.12.0
Any client with a session can drive callbacks on a shared WebSocketResource when the affected Native WebSocket message path is used. The issue occurs because resource authorization checks and @AuthorizeResource are not consulted on that path.
The fixes are available in 8.20.0, 9.25.0, and 10.12.0 for their respective release lines. Versions older than 8.x are unsupported and do not receive these fixes; 8.x and 9.x have reached end of life, so users should plan to move to Wicket 10 LTS or Wicket 11.
The issue affects Wicket versions from 8.0.0 before 8.20.0, 9.0.0 before 9.25.0, and 10.0.0 before 10.12.0. Exposure specifically involves a shared WebSocketResource whose callbacks can be reached through WebSocketMessageBroadcastHandler.