CVE-2026-66391
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in Apache Wicket due to use of insufficiently random values and protection mechanism failure. Affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Upgrade to version 10.10.0 is recommended.
Risk Assessment
Weak random values could allow an attacker to predict session tokens or other sensitive data, leading to application security compromise.
Recommendation
Upgrade Apache Wicket to version 10.10.0 or later.
Other vulnerabilities in Apache Wicket
See all- CVE-2026-43646High
Apache Wicket has a vulnerability that exposes sensitive information to unauthorized actors. This affects versions from 8.0.0 to 8.17.0, from 9.0.0 to 9.22.0, and from 10.0.0 to 10.8.0.
- CVE-2014-3526High
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via identifiers for storing page markup for temporary user sessions.
- CVE-2016-6806High
Apache Wicket versions 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 contain a security vulnerability that improperly handles CSRF prevention, failing to detect some cross-origin requests. The issue also involves not checking all Wicket server-side targets.
- CVE-2014-7808High
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.
- CVE-2016-6793Critical
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.
- CVE-2026-66390Medium
A Cross-Site Scripting (XSS) vulnerability in Apache Wicket due to improper input neutralization during web page generation. Affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Upgrade to version 10.10.0 is recommended.
Original NVD description (English source)
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.