Session Fixation Vulnerability in Apache Jackrabbit WebDAV Server
CVE-2026-92414

9.3CRITICAL

Key Information:

Vendor

Apache
Status
Apache Jackrabbit
Vendor
CVE Published:
7 October 2026

What is CVE-2026-92414?

A session fixation vulnerability exists in the Apache Jackrabbit WebDAV server that allows an attacker to leverage a cached authenticated session. This weakness arises from improper checks on token matches, specifically with Lock-Token, TransactionId, SubscriptionId, and If-header fields. As a result, authenticated sessions may be reused across different users, potentially leading to unauthorized access. Users are encouraged to upgrade to the latest versions—2.23.6, 2.22.5, or 2.20.18—to remediate this security issue.

Affected Version(s)

Apache Jackrabbit 2.23.0 <= 2.23.5

Apache Jackrabbit 2.22.0 <= 2.22.4

Apache Jackrabbit 2.20.0 <= 2.20.17

References

https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Julian Reschke
Claude Security
.