org.apache.wicket:wicket-auth-roles vulnerabilities

CVEs whose affected-version data names the org.apache.wicket:wicket-auth-roles package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-82840High· 7.2

5d ago

Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication

Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point thro…

▾ TwilightApache Software Foundation · org.apache.wicket:wicket-auth-rolesEPSS 0.30%via CVEORG