{"id":"CVE-2026-40010","aliases":["EUVD-2026-27554","GHSA-qpjw-p3jg-59j6"],"status":"published","title":"Apache Wicket: possible session fixation using AuthenticatedWebSession","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00379,"percentile":0.32328,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-384"],"published":"2026-05-06T08:34:30Z","modified":"2026-11-10T02:32:09Z","fixes":[{"ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","fixed_in":["10.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-M1"},{"last_affected":"8.17.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.22.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.8.0"},{"fixed":"10.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-M1"},{"last_affected":"8.17.0"}]}],"versions":["8.0.0","8.0.0-M1","8.0.0-M2","8.0.0-M3","8.0.0-M4","8.0.0-M5","8.0.0-M6","8.0.0-M7","8.0.0-M8","8.0.0-M9","8.1.0","8.10.0","8.11.0","8.12.0","8.13.0","8.14.0","8.15.0","8.16.0","8.17.0","8.2.0","8.3.0","8.4.0","8.5.0","8.6.0","8.6.1","8.7.0","8.8.0","8.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.22.0"}]}],"versions":["9.0.0","9.0.0-M1","9.0.0-M2","9.0.0-M3","9.0.0-M4","9.0.0-M5","9.1.0","9.10.0","9.11.0","9.12.0","9.13.0","9.14.0","9.15.0","9.16.0","9.17.0","9.18.0","9.19.0","9.2.0","9.20.0","9.21.0","9.22.0","9.3.0","9.4.0","9.5.0","9.6.0","9.7.0","9.8.0","9.9.0","9.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wicket:wicket-auth-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.9.0"}]}],"versions":["10.0.0","10.0.0-M1","10.0.0-M2","10.1.0","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.7.0","10.8.0"]}],"products":[{"vendor":"apache","product":"wicket"},{"vendor":"apache software foundation","product":"apache wicket"}],"references":[{"url":"https://lists.apache.org/thread/61wsc0xdtfd5oozojfx7by9w3jwgkmv1","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/06/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qpjw-p3jg-59j6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40010.json","tags":["advisory"]},{"url":"https://github.com/apache/wicket","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40010","title":"Apache Wicket: possible session fixation using AuthenticatedWebSession","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T08:34:30.48Z","modified":"2026-05-07T12:19:50.12Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-27554","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T08:34:30Z","modified":"2026-05-07T12:19:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:05:15.366699Z"}],"ghsa":[{"id":"GHSA-qpjw-p3jg-59j6","title":"Apache Wicket has a Session Fixation issue","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T12:30:25Z","modified":"2026-05-11T14:25:06Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-40010","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T10:16:20.093Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:12:17.418622Z"}],"osv":[{"id":"CVE-2026-40010","title":"Apache Wicket: possible session fixation using AuthenticatedWebSession","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T08:34:30.48Z","modified":"2026-11-10T02:32:09.131102929Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-10T02:45:42.584685Z"},{"id":"GHSA-qpjw-p3jg-59j6","title":"Apache Wicket has a Session Fixation issue","description":"Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T12:30:25Z","modified":"2026-05-11T14:56:27.195018Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}