Skip to main content

Apache Wicket EUVDEUVD-2026-68487

| CVE-2026-71378 MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-08-30 GHSA-298h-94gv-3jfv
XSS Apache CSRF Wicket
4.6
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
4.6 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
vuln.today AI
4.3 MEDIUM

Network vector, no attacker auth required, victim interaction required for browser navigation; integrity impact from unauthorized listener execution, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
CVSS changed
Aug 31, 2026 - 20:22 NVD
4.6 (MEDIUM)
CVE Published
Aug 31, 2026 - 10:50 cve.org
CRITICAL
Analysis Generated
Aug 31, 2026 - 00:17 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical CSRF Protection Bypass in Apache Wicket - CVE-2026-71378 Aug 31, 2026

AnalysisAI

Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The application must have deployed ResourceIsolationRequestCycleListener with the default FetchMetadataResourceIsolationPolicy as its CSRF control; this component was introduced in 9.1.0 and is absent in 8.x, so only applications on the affected 9.1.0-9.23.0 or 10.0.0-10.10.0 ranges are vulnerable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS vector or score was provided in the input; the vendor labels this 'moderate,' and independent assessment yields CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (approximately 4.3). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Apache Wicket 9.24.0 (for the 9.x line) or 10.11.0 (for the 10.x line), which fix both bypass conditions in FetchMetadataResourceIsolationPolicy; these versions are confirmed by the vendor advisory at https://wicket.apache.org/ and the oss-security post at https://seclists.org/oss-sec/2026/q3/617. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wicket

View all
CVE-2015-5347 MEDIUM POC
6.1 Apr 12

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.ma
CVE-2016-6793 CRITICAL
9.1 Jul 17

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a den
CVE-2024-36522 CRITICAL
9.8 Jul 12

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when proc
CVE-2016-6806 HIGH
8.8 Oct 03

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover
CVE-2014-3526 HIGH
7.5 Oct 30

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive
CVE-2014-7808 HIGH
7.5 Sep 15

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptog
CVE-2026-71257 HIGH
7.5 Aug 30

Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deploy
CVE-2021-23937 HIGH
7.5 May 25

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trig
CVE-2020-11976 HIGH
7.5 Aug 11

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. Rated high severity (CVSS 7.
CVE-2024-27439 MEDIUM
6.5 Mar 19

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.1.
CVE-2012-5636 MEDIUM
6.1 Oct 30

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0
CVE-2015-7520 MEDIUM
6.1 Apr 12

Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apac

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-68487 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy