CVE-2026-82840 | Apache Wicket up to 8.19.0/9.24.0/10.11.0 Authentication signIn session fixiation

November 2, 2026 Yanac

A vulnerability described as critical has been identified in Apache Wicket up to 8.19.0/9.24.0/10.11.0. This issue affects the function signIn of the component Authentication. Such manipulation leads to session fixiation.

This vulnerability is documented as CVE-2026-82840. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More