CVE-2026-92414

Apache Jackrabbit’s WebDAV server has a session fixation and session-reuse flaw (CWE-384). If a request’s Lock-Token, TransactionId, SubscriptionId, or If-header value matches a cached token, the server attaches that cached authenticated session without checking credentials. A remote unauthenticated attacker can then act as the user who owns the cached session, with high impact to confidentiality and integrity of repository content and no direct availability impact (CVSS 4.0 9.3); related reporting describes the lock tokens as derivable. Affected releases are 2.20.0–2.20.17, 2.22.0–2.22.4, and 2.23.0–2.23.5, fixed in 2.20.18, 2.22.5, and 2.23.6. It is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Apache Jackrabbit to 2.23.6, 2.22.5, or 2.20.18 on the matching release line. Until that is done, do not expose the WebDAV endpoint to untrusted networks, and after patching invalidate existing locks and authenticated sessions so previously cached sessions cannot be reused. Review WebDAV access logs for requests that supply Lock-Token, TransactionId, SubscriptionId, or If headers without a matching authentication.