CVE-2026-82840
Received Received - Intake

Session Fixation in Apache Wicket

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Apache Software Foundation

Description
Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an application authenticates a session. Renewing the container session id at that point is the standard defence against an attacker who has fixed a session id in a victim's browser, and Wicket provides that renewal as org.apache.wicket.Session#changeSessionId(), whose documentation directs callers to invoke it on login for exactly that reason. AuthenticatedWebSession#signIn(String, String) calls it inside a guard that succeeds only on the first transition of the session's signed-in flag. The session id is therefore renewed when a session first signs in, and is not renewed when a session that is already signed in authenticates again. signIn(String, String) returns true either way, so neither the caller nor the application can tell that the renewal did not happen. An application is affected where it authenticates through AuthenticatedWebSession, which AuthenticatedWebApplication requires and which the shipped UsernamePasswordPanel uses, and where a session that is already signed in can authenticate again: a step-up prompt before a sensitive action, an account switch, or simply a sign-in form that stays reachable once the user is signed in. Nothing in the module hides that form from a signed-in session. Reaching the defect also requires an attacker to place a session id of their choosing in the victim's browser. JSESSIONID is set by the servlet container rather than by Wicket, so that needs a position Wicket does not grant, such as control of a host under the same registrable domain or a container configured to carry the session id in the URL, and the planted session has to be one the attacker has already signed in on, because a session that is not yet signed in does have its id renewed by the victim's authentication. An authentication attempt that fails signs the session out and closes the window. Applications that renew the session id in their own code after a successful authentication are not affected. As a workaround, renew the session id from the application's own code on every successful authentication, by calling Session#changeSessionId() at the end of the authenticate(String, String) implementation. This issue affects Apache Wicket: from 8.18.0 through 8.19.0, from 9.23.0 through 9.24.0, from 10.9.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-82840

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a session fixation vulnerability in Apache Wicket. It occurs when an attacker sets a victim's session ID before authentication, allowing them to hijack the session after login. The issue is that Wicket's AuthenticatedWebSession does not renew the session ID on subsequent logins, only on the first login. This means if a user is already logged in and authenticates again, the session ID remains unchanged, enabling session fixation attacks.

Detection Guidance

Detecting this vulnerability requires checking if your Apache Wicket application is using an affected version (8.18.0-8.19.0, 9.23.0-9.24.0, or 10.9.0-10.11.0) and verifying if session IDs are renewed during re-authentication. Review application logs for session fixation patterns or manual session ID checks during login flows.

Impact Analysis

An attacker could hijack a user's session after they log in, gaining unauthorized access to sensitive data or actions. This is possible if the attacker can set a session ID in the victim's browser, such as by controlling a host under the same domain or exploiting a container configured to carry session IDs in URLs. The impact includes potential data breaches, unauthorized account access, or privilege escalation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing session fixation attacks, which may lead to unauthorized access to sensitive user data. If an attacker fixes a session ID in a victim's browser, they could hijack an authenticated session, potentially violating data confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or later. As a temporary workaround, manually call Session#changeSessionId() in your authenticate(String, String) method after successful authentication to renew session IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...