CVE-2026-92414
published 2026-10-07CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.73%
53.8th percentile
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | jackrabbit | >= 2.20.0 < 2.20.18 | 2.20.18 |
| apache | jackrabbit | >= 2.22.0 < 2.22.5 | 2.22.5 |
| apache | jackrabbit | >= 2.23.0 < 2.23.6 | 2.23.6 |
| apache_software_foundation | apache_jackrabbit | 2.20.0 – 2.20.17 | — |
| apache_software_foundation | apache_jackrabbit | 2.22.0 – 2.22.4 | — |
| apache_software_foundation | apache_jackrabbit | 2.23.0 – 2.23.5 | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.jackrabbit/jackrabbit-webdav: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
vendor_redhat·2026-10-07·CVSS 9.3
CVE-2026-92414 [CRITICAL] CWE-613 org.apache.jackrabbit/jackrabbit-webdav: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
org.apache.jackrabbit/jackrabbit-webdav: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
A flaw was found in jackrabbit-webdav. The WebDAV (Web Distributed Authoring and Versioning) server attaches a cached authenticated session when request header tokens—such as lock, transaction, or subscri
GHSA
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
ghsa_unreviewed·2026-10-07
CVE-2026-92414 [CRITICAL] CWE-384 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
No detection rules found.
No public exploits indexed.
2026-10-07
Published