Threats affecting pkg:maven/org.apache.wicket/wicket-native-websocket-core

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 suffer from insufficient session expiration in its native WebSocket support. The issue arises because the WebSocket connection uses a copy of the HTTP session made at connection time, which detaches it from the live container session. Consequently, invalidating the container session does not end the WebSocket connection, allowing the connection to continue operating with the old session state, including any authenticated identity. Some containers may close the WebSocket when the HTTP session ends, but this behavior is container-dependent. The vulnerability is fixed in Apache Wicket versions 8.20.0, 9.25.0, and 10.12.0.

CVE-2026-82558 is a missing authorization vulnerability in Apache Wicket's WebSocketBehavior component. The issue arises because WebSocketBehavior does not verify if a client is authorized to invoke the component it is attached to before calling onMessage() callbacks. This contrasts with Ajax behaviors, which perform authorization checks. The vulnerability affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. Fixed versions are 8.20.0, 9.25.0, and 10.12.0. Exploitation requires the client to have their own session and page containing the affected component, limiting cross-user impact. Server-pushed messages are not affected.

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a missing authorization vulnerability in the WebSocketMessageBroadcastHandler. This handler delivers incoming WebSocket frames directly to shared resources without consulting the configured authorization strategy, allowing authenticated users to invoke resource callbacks without proper authorization checks. The vulnerability affects applications that register WebSocketResource as shared resources and rely on authorization strategies to restrict access. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.