CVE-2026-92414CWE-384

CVE-2026-92414

Critical · published October 7, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with

no credential check.

This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.

Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00725 · 53.5th percentile
Weakness
CWE-384 · Session Fixation
Published
2026-10-07T20:19Z
Affected products (3)
ProductVersionsFixed in
apache/jackrabbit≥ 2.20.0, < 2.20.182.20.18
apache/jackrabbit≥ 2.22.0, < 2.22.52.22.5
apache/jackrabbit≥ 2.23.0, < 2.23.62.23.6
References (2)
https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr · [email protected]http://www.openwall.com/lists/oss-security/2026/10/07/27 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 1%
    epss
  • 07 OCT 15:46Z
    Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
    cvelistv5