Critical severity · published Oct 7, 2026
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AJ
Apache Jackrabbit · Apache Software Foundation
2.23.0 through 2.23.5; 2.22.0 through 2.22.4; 2.20.0 through 2.20.17 · source: vendor
JA
Jackrabbit · Apache
2.20.0 before 2.20.18; 2.22.0 before 2.22.5; 2.23.0 before 2.23.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92414
vendor-advisory
https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr
More from Apache Jackrabbit
5.3
CVE-2026-92415
Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies