Session Fixation Vulnerability in Apache Wicket Products

CVE-2026-82840

What is CVE-2026-82840?

The vulnerability in Apache Wicket stems from improper session ID renewal during the authentication process. Specifically, the issue arises in the AuthenticatedWebSession class, where the signIn method does not renew the session ID when a user who is already signed in attempts to authenticate again. This oversight allows potential attackers to exploit a fixed session ID in a victim's browser, leading to unauthorized access. It is critical for applications relying on this authentication mechanism to implement session ID renewal proactively after successful logins to mitigate this security risk. Users should upgrade to the latest versions to ensure protection against this vulnerability.

References