EUVD-2026-114888

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage callbacks without checking whether the client may invoke the component the behavi...

CVE-2026-82558

Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , 10.0.0 through 10.11.0 , and unsupported releases from 6.0.0 onwards are vulnerable to a missing authorization flaw. The org.apache.wicket.protocol.ws.api.WebSocketBehavior fails to verify if a client is permitted to invoke the ...