CVE-2026-66391

Analyzed Analyzed - Analysis Complete

Insufficient Randomness in Apache Wicket

Publication date: 2026-07-27

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-05

Generated

2026-08-16

AI Q&A

2026-07-27

EPSS Evaluated

2026-08-15

NVD

CVE-2026-66391

EUVD

EUVD-2026-49368

Affected Vendors & Products

Vendor	Product	Version / Range
apache	wicket	From 9.0.0 (inc) to 9.23.0 (inc)
apache	wicket	From 10.0.0 (inc) to 10.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-330	The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Wicket is due to the use of insufficiently random values, which can lead to protection mechanism failures. It affects versions from 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. Users are advised to check Apache Wicket versions and upgrade to 10.10.0 or later to mitigate the risk.

Impact Analysis

The vulnerability may allow attackers to bypass security mechanisms by exploiting predictable values, potentially leading to unauthorized access or data breaches. Users should upgrade to version 10.10.0 or later to mitigate this risk.

Compliance Impact

This vulnerability involves insufficiently random values and protection mechanism failure in Apache Wicket, which could lead to predictable session tokens or weak cryptographic operations. This may expose sensitive data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Apache Wicket to version 10.10.0 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-66391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70