EUVD-2026-114888

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage callbacks without checking whether the client may invoke the component the behavi...