Missing Authorization Vulnerability in Apache Wicket WebSocket Support

CVE-2026-82558

What is CVE-2026-82558?

This vulnerability in Apache Wicket's WebSocket support arises from inadequate authorization checks when handling messages sent by clients. The issue is specifically due to the WebSocketBehavior's onMessage() callbacks being invoked without verifying whether the client has permission to access the behavior's associated component. Instances where WebSocketBehavior is linked to components that are hidden or restricted by authorization strategies could expose applications to unauthorized message handling, albeit only within a user's session context. This vulnerability affects users running Apache Wicket versions from 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0, as well as earlier unsupported versions from 6.0.0 onwards. Users are advised to upgrade to secure versions 8.20.0, 9.25.0, or 10.12.0 to fully mitigate this risk.

References