Vulnerability · Published Oct 7, 2026 · Assigned by apache
CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
Critical 9.3
In plain English
A critical-severity session fixation in Apache Jackrabbit from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jackrabbit | no fix listed | DEBIAN-CVE-2026-92414 |
| Debian:13 | jackrabbit | no fix listed | DEBIAN-CVE-2026-92414 |
| Debian:14 | jackrabbit | no fix listed | DEBIAN-CVE-2026-92414 |
| Ubuntu:22.04:LTS | jackrabbit | no fix listed | UBUNTU-CVE-2026-92414 |
| Ubuntu:24.04:LTS | jackrabbit | no fix listed | UBUNTU-CVE-2026-92414 |
| Ubuntu:26.04:LTS | jackrabbit | no fix listed | UBUNTU-CVE-2026-92414 |
| Ubuntu:26.10 | jackrabbit | no fix listed | UBUNTU-CVE-2026-92414 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Jackrabbit | 2.23.0 – through 2.23.52.22.0 – through 2.22.42.20.0 – through 2.20.17 |
Weakness: CWE-384 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N