EUVD-2026-114886

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls...

CVE-2026-82115

A missing authorization vulnerability in Apache Wicket allows unauthorized access to shared WebSocketResource objects. The root cause is that WebSocketMessageBroadcastHandler calls WebSocketResource#onPayload() directly without consulting IAuthorizationStrategy#isResourceAuthorized(), bypassing t...