# CVE-2026-82559: Apache Wicket insufficient WebSocket session expiration

Source: https://junglewise.ai/threats/cve-2026-82559-insufficient-session-expiration-in-apache-wicket-org-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-82559 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web framework that handles user sessions and WebSocket connections. When a user's session is terminated by the web server, WebSocket connections in Wicket fail to disconnect and continue using the stale session data, allowing an attacker with an open connection to maintain access to that user's identity and permissions even after logout. This affects applications using Wicket's native WebSocket support on pages requiring authentication.

Technologies: [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82559 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82559 being exploited in the wild.

**How severe is CVE-2026-82559?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 6.0.0 onwards (unsupported).

**Is there a fix for CVE-2026-82559?** Yes: fixed in 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82559 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82559?** Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.20.0, 9.25.0, 10.12.0

## Technical details

The vulnerability exists in org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest(), which copies the container session into an HttpSessionCopy at connection time and reuses it for all subsequent frames. When the container invalidates the session via idle timeout, security framework logout, or session replacement, the WebSocket connection continues to resolve the stale session copy rather than the invalidated live session. This allows authorization decisions within WebSocket callbacks to be made against revoked identities. The issue affects WebSocketBehavior on pages and all WebSocketResource connections; it does not affect applications without native WebSocket support.

## Affected products

- Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 6.0.0 onwards (unsupported)

## Timeline

- 2026-11-01: disclosed

## Related threats

- [Apache Wicket improper input neutralization in JavaScript generation](https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket missing Content-Security-Policy headers with nested request handler delegates](https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content)
- [Apache Wicket ExternalLink reflected XSS in onclick attribute](https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket path validation bypass in package resource handling](https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is)
- [Apache Wicket template disclosure via class loader misconfiguration](https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache)