CVE-2026-40010: Apache Wicket Auth Bypass Vulnerability

CVE-2026-40010 Overview

CVE-2026-40010 is a session fixation vulnerability in Apache Wicket, a component-based Java web application framework. The flaw stems from a missing invocation of the Servlet HTTP web request method changeSessionId after session binding. This omission allows an attacker to fixate a known session identifier on a victim and inherit the authenticated session once the victim logs in. The issue affects Apache Wicket versions 8.0.0 through 8.17.0, version 9.0.0, and versions 10.0.0 through 10.8.0. The Apache Software Foundation has released version 10.9.0 to address the issue.

Critical Impact

Successful exploitation enables an unauthenticated, remote attacker to hijack authenticated user sessions, leading to account takeover and unauthorized access to confidential application data.

Affected Products

• Apache Wicket 8.0.0 through 8.17.0
• Apache Wicket 9.0.0
• Apache Wicket 10.0.0 through 10.8.0

Discovery Timeline

• 2026-05-06 - CVE-2026-40010 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-40010

Vulnerability Analysis

The vulnerability is classified under [CWE-384] Session Fixation. Apache Wicket fails to call HttpServletRequest.changeSessionId() after a user session is bound following authentication. As a result, the session identifier issued before authentication continues to identify the authenticated session.

An attacker who plants a known session ID in the victim's browser, for example through a crafted link or a network-injected Set-Cookie header, can reuse that identifier after the victim authenticates. The attacker then operates as the authenticated user without ever knowing the victim's credentials.

The attack can be carried out remotely over the network, requires no privileges, and does not require user interaction beyond visiting an attacker-influenced page or following a crafted link.

Root Cause

The Servlet 3.1 specification introduced changeSessionId() to mitigate session fixation by rotating the session identifier on privilege transitions. Apache Wicket's session binding logic did not invoke this method when associating an authenticated principal with the active session. The pre-authentication identifier therefore persisted across the authentication boundary, breaking the security assumption that authentication invalidates anonymous session state.

Attack Vector

A typical exploitation chain proceeds as follows. The attacker first obtains a valid JSESSIONID from the target Wicket application. The attacker then induces the victim to use that identifier through cross-site scripting, a malicious link with the session ID in a URL parameter, or a network man-in-the-middle position that injects a session cookie. When the victim authenticates, the application binds the authenticated principal to the attacker-chosen session ID. The attacker, holding the same identifier, replays it and accesses the victim's authenticated session. Detailed discussion is available in the Apache Mailing List Discussion and the OpenWall OSS Security Update.

Detection Methods for CVE-2026-40010

Indicators of Compromise

• A JSESSIONID value that remains identical across the unauthenticated and authenticated portions of a user's request stream.
• Multiple distinct source IP addresses or User-Agent strings using the same session identifier within a short time window.
• Session cookies arriving in inbound requests that were never previously issued by the application in a Set-Cookie response.
• Authentication events on Wicket endpoints not preceded by a session ID rotation in access logs.

Detection Strategies

• Inventory deployed Apache Wicket versions across web tiers and flag any instance running 8.0.0 through 8.17.0, 9.0.0, or 10.0.0 through 10.8.0.
• Correlate web server access logs to identify session IDs that appear unchanged before and after the login endpoint is hit.
• Alert on concurrent use of the same JSESSIONID from geographically or network-distinct sources.
• Inspect application logs for authentication success events that do not coincide with a fresh session identifier.

Monitoring Recommendations

• Forward web access logs and Wicket application logs to a centralized analytics platform for cross-session correlation.
• Track baselines of session ID rotation frequency to surface deviations from expected post-authentication behavior.
• Monitor outbound Set-Cookie headers from authentication endpoints to confirm new session identifiers are issued on login.

How to Mitigate CVE-2026-40010

Immediate Actions Required

• Upgrade Apache Wicket to version 10.9.0, which adds the missing changeSessionId() invocation after session binding.
• Identify all internal and external applications built on vulnerable Wicket versions and prioritize patching for internet-facing deployments.
• Invalidate all currently active sessions after upgrading to ensure any pre-existing fixated identifiers are revoked.
• Review authentication audit logs for the indicators listed above to identify possible prior abuse.

Patch Information

Apache Wicket 10.9.0 resolves CVE-2026-40010 by ensuring the application calls HttpServletRequest.changeSessionId() when binding an authenticated session. Refer to the Apache Mailing List Discussion for the official advisory and upgrade guidance. Users on the 8.x and 9.x branches should evaluate migration paths to a fixed branch as no backport is referenced in the advisory.

Workarounds

• Configure the servlet container to rotate session identifiers on authentication using container-level features such as <session-config> rotation policies where supported.
• Apply a custom AuthenticatedWebSession subclass override that explicitly calls request.changeSessionId() after a successful sign-in until the upgrade can be deployed.
• Enforce the HttpOnly, Secure, and SameSite=Strict attributes on JSESSIONID cookies to limit attacker ability to plant identifiers via cross-site channels.
• Terminate plaintext HTTP listeners and require TLS to reduce the feasibility of network-based session injection.

# Example Maven dependency update to the fixed version
<dependency>
  <groupId>org.apache.wicket</groupId>
  <artifactId>wicket-core</artifactId>
  <version>10.9.0</version>
</dependency>