Insufficient Session Expiration in Apache Wicket WebSocket Support

CVE-2026-82559

What is CVE-2026-82559?

An insufficient session expiration vulnerability in Apache Wicket's WebSocket support arises when WebSocket connections maintain a detached copy of the session attributes after the initial connection is made. This means that even if the container session is invalidated or replaced, the WebSocket connection continues to operate under the old session context, potentially allowing unauthorized access. If applications utilize Wicket’s native WebSocket features on authenticated pages or shared resources, they become susceptible to session fixation attacks post session termination. Apache Wicket users are urged to upgrade to the latest versions to mitigate this issue.

References