CVE-2026-82558 Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage callbacks without checking whether the client may invoke the component the behavi...