CVE-2026-71378: Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener

<p>Posted by Emond Papegaaij on Aug 30</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Wicket (org.apache.wicket:wicket-core) 9.1.0 through 9.23.0<br /> - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.10.0<br /> <br /> Description:<br /> <br /> ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by re