CVE-2026-40010 is a critical session fixation flaw in Apache Wicket, rated CVSS 9.1. Wicket does not call the servlet changeSessionId method after a session is bound, so a session id set before login can survive it. The Apache advisory names Wicket 10.9.0 as the fixed release.
What's affected
The record and the Apache announcement on oss-security list these ranges:
- Apache Wicket 8.0.0 through 8.17.0
- Apache Wicket 9.0.0 through 9.22.0 (the NVD text says 9.0.0)
- Apache Wicket 10.0.0 through 10.8.0
Fixed version: 10.9.0. The announcement is titled "possible session fixation using AuthenticatedWebSession", which points at applications that use that class for login. I did not find a patched 8.x or 9.x release named in the sources, so if you are on those lines, ask the Wicket project or check its release notes before assuming a backport exists.
How to check if you're exposed
List the Wicket version your build resolves. For Maven:
mvn dependency:tree -Dincludes=org.apache.wicket
For Gradle:
./gradlew dependencies --configuration runtimeClasspath | grep -i wicket
Any wicket-core version in the ranges above is affected. Then search your code for AuthenticatedWebSession and for custom session classes that bind a session after login, because those are the paths the advisory describes.
What to do now
- Find every application that depends on Apache Wicket, including internal tools.
- Upgrade to Wicket 10.9.0. Plan the move from 8.x or 9.x if that is where you sit, since no patched release on those lines is named in the advisory.
- After upgrading, log in and confirm the session id changes between the anonymous page and the authenticated page.
- Invalidate existing sessions at deploy time so ids issued before the fix are not reused.
- Record the new version in your dependency inventory.
Why it matters
The weakness is CWE-384, session fixation. If an application keeps the same session id before and after authentication, anyone who can plant a known id in a victim's browser can later use that same id as the logged in user. Rotating the id at login is the standard defence, and in servlet containers that is what changeSessionId does.
The CVSS vector is network reachable with no privileges and no user interaction, scored high for confidentiality and integrity. Real exposure still depends on whether an attacker can get a chosen id into a victim's browser. The record does not mark it as exploited in the wild.
Quick check
Is CVE-2026-40010 exploited in the wild?
The record shows the KEV flag as false and the Apache announcement does not mention exploitation. Treat it as a priority upgrade, not an active incident.
Sources
Last reviewed: 19 October 2026.
