ResourceIsolationRequestCycleListener was designed to prevent CSRF by rejecting requests that violate a resource isolation policy. However, the default FetchMetadataResourceIsolationPolicy mistakenly permits two classes of requests that are unsafe. First, any top‑level GET navigation that does not target an object or embed is allowed, even if it originates from a different site. Because browsers send Lax cookies on such navigations, an attacker can cause a victim’s authenticated session to invoke link callbacks, form submissions or other page actions. Second, the policy allows requests whose Sec‑Fetch‑Site header indicates same‑site, meaning the same registrable domain and scheme but a different origin. This permits a sibling origin, such as a subdomain or alternate port, to send POST form submissions that include the victim’s session cookie and trigger any listener. These weaknesses allow an attacker to perform unauthorized actions on behalf of the victim, compromising confidentiality and integrity of data handled by those listeners.

The vulnerability affects Apache Wicket releases 9.1.0 through 9.23.0 and 10.0.0 through 10.10.0. Versions prior to 9.1.0, including all 8.x releases, do not contain the ResourceIsolationRequestCycleListener and are not impacted.

The abnormal policy logic has no publicly available EPSS score and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the risk is substantial because exploitability requires only the ability to persuade a victim’s browser to load a crafted URL or to host a malicious sibling origin. Successful exploitation would enable a remote attacker to trigger arbitrary authenticated actions within the victim’s session, potentially leading to data disclosure, unauthorized data modification or account takeover. All affected installations should apply the official patch promptly to eliminate the flaw.