What is the CVSS score of CVE-2026-40010?

CVE-2026-40010 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Wicket are affected by CVE-2026-40010?

Apache Wicket versions 8.0.0-10.8.0 contain a critical session fixation vulnerability in AuthenticatedWebSession that enables unauthenticated attackers to hijack active user sessions and escalate…. A patch is available.

How to fix or mitigate CVE-2026-40010?

Within 24 hours: Identify all applications using Apache Wicket and determine affected versions (8.0.0-8.17.0, 9.0.0-9.22.0, 10.0.0-10.8.0) in your environment. Within 7 days: Apply vendor-released patches to all affected instances-consult Apache Wicket security advisories for specific patch versions per major branch (8.x, 9.x, 10.x). Within 30 days: Complete application testing and deploy patched versions to production; validate session management behavior post-patch.

Apache Wicket CVE-2026-40010

EUVD-2026-27554 CRITICAL

Session Fixation (CWE-384)

2026-05-06

GHSA-qpjw-p3jg-59j6

Session Fixation Apache Information Disclosure

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 20:37 vuln.today

CVSS changed

May 06, 2026 - 20:37 NVD

9.1 (CRITICAL)

CVE Published

May 06, 2026 - 00:45 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on org.apache.wicket:wicket-auth-roles (4 direct, 1 indirect)

Ecosystem-wide dependent count for version 8.0.0-M1.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Session fixation in Apache Wicket AuthenticatedWebSession allows remote unauthenticated attackers to hijack user sessions and escalate privileges by fixing session identifiers before authentication completes. Affects Wicket 8.0.0-8.17.0, 9.0.0-9.22.0, and 10.0.0-10.8.0. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability despite critical CVSS 9.1, suggesting this requires specific deployment conditions. Not listed in CISA KEV; no public POC identified at time of analysis. Apache has published vendor advisories with fix versions across all three major release branches.

Technical ContextAI

Apache Wicket is a component-based Java web application framework. CWE-384 (Session Fixation) occurs when an application accepts externally-supplied session identifiers without regenerating them upon authentication state changes. The AuthenticatedWebSession class in Wicket manages user authentication state across HTTP requests. Session fixation exploits this by having an attacker pre-establish a session ID, trick a victim into authenticating with that fixed ID, then use the now-authenticated session to impersonate the victim. The vulnerability exists across three major Wicket release branches (8.x, 9.x, 10.x), affecting products using CPE identifiers cpe:2.3:a:apache:wicket for versions 8.0.0-8.17.0, 9.0.0-9.22.0, and 10.0.0-10.8.0. This architectural flaw in session lifecycle management violates OWASP ASVS requirements for session token regeneration on authentication events.

RemediationAI

Upgrade Apache Wicket to patched versions: 8.18.0 or later for the 8.x branch, 9.23.0 or later for the 9.x branch, or 10.9.0 or later for the 10.x branch. Consult the Apache security advisory at https://lists.apache.org/thread/61wsc0xdtfd5oozojfx7by9w3jwgkmv1 for exact fix versions and migration guidance. If immediate patching is not feasible, implement compensating controls: explicitly regenerate session identifiers upon successful authentication by calling Session.get().replaceSession() in authentication success handlers before granting authenticated access; enforce strict session cookie attributes (Secure, HttpOnly, SameSite=Strict) to limit session ID leakage; implement short session timeouts pre-authentication to reduce the window for fixation attacks; and monitor for suspicious patterns such as session IDs reused across authentication boundaries or session upgrades from unauthenticated to authenticated states without ID regeneration. Note that workarounds add application logic complexity and may impact performance under high authentication loads; vendor-released patches remain the definitive remediation. Review application logs for anomalous session reuse patterns that might indicate historical exploitation attempts.