Cross-site request forgery in Apache Wicket - CVE-2026-71378
Published: August 31, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass cross-site request forgery protections and perform actions in the victim's session.
The vulnerability exists due to improper access control in ResourceIsolationRequestCycleListener and its default FetchMetadataResourceIsolationPolicy when handling cross-site requests judged by the resource isolation policy. A remote attacker can cause the victim's browser to send a crafted cross-site request to listener URLs to bypass cross-site request forgery protections and perform actions in the victim's session.
Requests using simple top-level GET navigations or requests from same-site sibling origins may be accepted, and exploitation relies on the victim's browser sending the user's session cookies with the request.