CVE-2026-82559 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Wicket applications, particularly those using WebSocket support on pages or shared resources that require an authenticated session, should assess exposure and prioritize upgrading to the fixed versions.

Why it matters

Insufficient session expiration in Apache Wicket allows an attacker to maintain access to a user's session even after the session has been invalidated, potentially leading to unauthorized access.

• Potential unauthorized access to user sessions
• Maintaining access to a user's session even after session invalidation
• Bypassing session expiration and invalidation mechanisms

Technical summary

The issue arises from the way Apache Wicket handles WebSocket connections and session expiration. When a WebSocket connection is established, Wicket creates a copy of the HTTP session, which is not updated when the original session is invalidated. This allows an attacker to maintain access to a user's session even after the session has been invalidated. The issue affects Apache Wicket versions from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, and from 10.0.0 through 10.11.0. Defenders should prioritize upgrading to the fixed versions of Apache Wicket to prevent potential unauthorized access to user sessions. Additionally, defenders should review and update session management configurations to ensure proper

Defensive priority

Defenders should prioritize upgrading to the fixed versions of Apache Wicket to prevent potential unauthorized access to user sessions.

Recommended defensive actions

• Upgrade to Apache Wicket version 8.20.0, 9.25.0, or 10.12.0
• Review and update session management configurations
• Monitor for potential unauthorized access to user sessions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the issue, but do not offer additional context or affected versions beyond what is already publicly known. The issue is caused by Wicket's WebSocket implementation, which creates a copy of the HTTP session that is not updated when the original session is invalidated. This allows an attacker to maintain access to a user's session even after the session has been invalidated. Users are recommended to review their Wicket configurations and ensure proper session invali

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.