How does Wicket handle recent security vulnerabilities like session fixation issues?

Wicket's security response follows a standard open-source pattern: identify the issue, assign it a CVE, fix it in the affected code, and ship the fix as a patch release across every currently maintained branch — not just the newest one.

A concrete recent example: in 2026, Wicket shipped fixes for several issues in close succession, including CVE-2026-40010, a possible session fixation risk involving AuthenticatedWebSession, alongside a resource-guard bypass (CVE-2026-43646), a path-traversal issue in file upload handling (CVE-2026-43975), and a way crafted strings could break out of an escaped JavaScript sequence (CVE-2026-42509). Notably, the same set of fixes landed across the 8.18.0, 9.23.0, and 10.9.0/10.10.0 releases within weeks of each other, reflecting that all three major branches were actively receiving security patches at the same time rather than only the newest line getting attention.

Session fixation specifically refers to an attacker forcing a known session identifier onto a victim and then hijacking that session once the victim authenticates under it — the class of bug the AuthenticatedWebSession fix addressed by making sure a session identifier is properly regenerated around the authentication transition rather than being reused as-is.