Apache Wicket versions from 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, and 10.0.0 through 10.8.0 are affected by a session fixation vulnerability (CVE-2026-40010). The issue arises from missing invocation of the Servlet HTTP request method changeSessionId after session binding, which can allow an attacker to fixate a user's session ID. This vulnerability is fixed in version 10.9.0.