CVE-2026-82558 | Apache Wicket up to 8.19.0/9.24.0/10.11.0 WebSocket Behavior WebSocketBehavior.java onMessage improper authorization

November 2, 2026 Yanac

A vulnerability classified as critical was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0. The affected element is the function onMessage of the file org/apache/wicket/protocol/ws/api/WebSocketBehavior.java of the component WebSocket Behavior. Executing a manipulation can lead to improper authorization.

This vulnerability appears as CVE-2026-82558. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is advised.VulDB Recent EntriesRead More