org.apache.wicket:wicket-auth-roles (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.apache.wicket:wicket-auth-roles, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (1)

• CVE-2026-40010 — CVSS 9.1 (critical): Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack…