Threats affecting pkg:maven/org.apache.wicket/wicket-auth-roles

CVE-2026-82840 is a session fixation vulnerability in Apache Wicket's authentication module. The flaw occurs because the session ID is only renewed on the first sign-in, not on subsequent authentications within an already signed-in session. This allows an attacker who can fix a session ID in a victim's browser to reuse that session after the victim re-authenticates, potentially bypassing session renewal protections. The issue affects Apache Wicket versions 8.18.0 through 8.19.0, 9.23.0 through 9.24.0, and 10.9.0 through 10.11.0. Upgrading to versions 8.20.0, 9.25.0, or 10.12.0 resolves the vulnerability.

Apache Wicket versions from 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, and 10.0.0 through 10.8.0 are affected by a session fixation vulnerability (CVE-2026-40010). The issue arises from missing invocation of the Servlet HTTP request method changeSessionId after session binding, which can allow an attacker to fixate a user's session ID. This vulnerability is fixed in version 10.9.0.