Paper/Archive/CVE-2026-92414

CVE-2026-92414

Apache Software Foundation Apache Jackrabbit — Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

EPSS 0.7%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 54.0.540 × 2010.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Affected

ProductAffectedFixed inSource

Apache Jackrabbit2.23.0 – 2.23.5–CNA

Apache Jackrabbit2.22.0 – 2.22.4–CNA

Apache Jackrabbit2.20.0 – 2.20.17–CNA

Scores by source

apache (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr refopenwall.com/lists/oss-security/2026/10/07/27