EUVD-2026-114892

Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signInString, String method is the entry point through which an application authenticates a session. Renewing the...

CVE-2026-82840

Apache Wicket is vulnerable to Session Fixation due to the behavior of AuthenticatedWebSession#signIn(String, String). The session ID is only renewed during the first transition of the session's signed-in flag. Consequently, if a session is already signed in and undergoes re-authentication (e.g.,...