# CVE-2026-82898: Apache Wicket incorrect security check order in resource isolation

Source: https://junglewise.ai/threats/cve-2026-82898-incorrect-order-of-security-checks-in-apache-wicket-org-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-82898 · Severity: info · Published 2026-11-01

Apache Wicket is a web application framework used to build interactive Java web applications. A logic error allows attackers to bypass cross-origin request protections and inject form field values from a malicious site, potentially leading to unauthorized actions when a user signs in after being redirected. This affects applications that use Wicket's resource isolation policies and authentication interception.

Technologies: [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82898 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82898 being exploited in the wild.

**How severe is CVE-2026-82898?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Apache Wicket 9.1.0 through 9.24.0, 10.0.0 through 10.11.0.

**Is there a fix for CVE-2026-82898?** Yes: fixed in 9.25.0, 10.12.0. Until then: As a workaround, refuse unauthorized access using org.apache.wicket.RestartResponseException instead of org.apache.wicket.RestartResponseAtInterceptPageException; this exception does not store the original destination URL and prevents the form field injection.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-01"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82898 attacked?** It is attacked over the network or from the adjacent network.

**Am I affected by CVE-2026-82898?** Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.25.0, 10.12.0

As a workaround, refuse unauthorized access using org.apache.wicket.RestartResponseException instead of org.apache.wicket.RestartResponseAtInterceptPageException; this exception does not store the original destination URL and prevents the form field injection.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-01"}]

## Technical details

The ResourceIsolationRequestCycleListener instantiates a page before consulting resource isolation policies; instantiation triggers IAuthorizationStrategy, which may throw RestartResponseAtInterceptPageException to intercept unauthenticated requests. The exception handler stores the full intercepted URL including query string, and after authentication, Wicket redirects to this URL as a same-origin request, allowing the policies to pass. Form fields in the query string are then processed with the now-authenticated session, bypassing origin checks. An attacker can leverage this by crafting a cross-origin request and having an authenticated user complete sign-in.

## Affected products

- Apache Wicket 9.1.0 through 9.24.0, 10.0.0 through 10.11.0

## Related threats

- [Apache Wicket improper input neutralization in JavaScript generation](https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket missing Content-Security-Policy headers with nested request handler delegates](https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content)
- [Apache Wicket ExternalLink reflected XSS in onclick attribute](https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket path validation bypass in package resource handling](https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is)
- [Apache Wicket template disclosure via class loader misconfiguration](https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache)