← CVE Radar
CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
9.3 CRITICALEPSS 0.72%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 4.0apache (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 9.1 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-92414
- Status
- Analyzed
- Assigner (CNA)
- apache
- Published
- Oct 7, 2026
- Last modified
- 2026-10-13 14:24 UTC
- Weaknesses
- CWE-384 · Session Fixation / Session Reuse across Users
Affected Products
As published by the CNA in the CVE record.
Apache Software FoundationApache Jackrabbit3 version ranges
- 2.23.0 through 2.23.5
- 2.22.0 through 2.22.4
- 2.20.0 through 2.20.17