CVE-2026-40010

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Wicket	>= 10.0.0, <= 10.8.0; >= 8.0.0, <= 8.17.0; >= 9.0.0, <= 9.22.0

References

https://lists.apache.org/thread/61wsc0xdtfd5oozojfx7by9w3jwgkmv1Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/06/1Mailing List, Third Party Advisory

Timeline

Published: May 6, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-400113.7An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing inval CVE-2026-400125.3ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;CVE-2026-400134.3An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write CVE-2026-400146.5An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the s CVE-2026-400154.3An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermit CVE-2026-400166.5Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 CVE-2026-400176.5An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which make CVE-2026-400187.4None None None No publicly available exploits are known.CVE-2026-400195.9An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop c CVE-2026-40024.3The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to miss CVE-2026-400204.3Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This c CVE-2026-400215.3Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J http