https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 06:37:21 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-82115 <p>Missing authorization in Apache Wicket.</p> <p>org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket&#39;s native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client&#39;s handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect.</p> <p>A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource&#39;s callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller&#39;s own connection.</p> <p>An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource&#39;s callbacks do wi…</p> <p>Missing authorization in Apache Wicket.</p> <p>org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket&#39;s native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client&#39;s handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect.</p> <p>A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource&#39;s callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller&#39;s own connection.</p> <p>An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource&#39;s callbacks do wi…</p> https://db.gcve.eu/vuln/fkie_cve-2026-82115 https://db.gcve.eu/vuln/ghsa-fcp8-rfgx-8mhm <p>Missing authorization in Apache Wicket.</p> <p>org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket&#39;s native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client&#39;s handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect.</p> <p>A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource&#39;s callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller&#39;s own connection.</p> <p>An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource&#39;s callbacks do wi…</p> <p>Missing authorization in Apache Wicket.</p> <p>org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket&#39;s native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client&#39;s handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect.</p> <p>A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource&#39;s callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller&#39;s own connection.</p> <p>An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource&#39;s callbacks do wi…</p> https://db.gcve.eu/vuln/ghsa-fcp8-rfgx-8mhm