CVE-2026-66391

Summary

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.

Users are recommended to upgrade to version 10.10.0, which fixes the issue.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache Wicket9.0.0 <= 9.23.0affected
Apache Software FoundationApache Wicket10.0.0 <= 10.9.0affected

Weaknesses

  • CWE-330: CWE-330 Use of Insufficiently Random Values
  • CWE-693: CWE-693 Protection Mechanism Failure

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References