CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
CVE-2026-92414 lets unauthenticated attackers hijack cached Apache Jackrabbit WebDAV sessions and is rated CVSS 9.3.
Apache Jackrabbit is affected by CVE-2026-92414, a session-fixation and session-reuse flaw in its WebDAV server that can let an unauthenticated attacker hijack cached authenticated sessions through derivable lock tokens. The advisory rates it CVSS 4.0 9.3, with network access, low complexity, no privileges or user interaction, and high confidentiality and integrity impact. Affected releases are 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5. The posted notice does not report exploitation in the wild.
- CVE-2026-92414 is a pre-authentication session-fixation flaw in Jackrabbit WebDAV.
- CVSS 4.0 is 9.3: network access, no privileges, high confidentiality and integrity.
- Affected ranges are 2.20.0–2.20.17, 2.22.0–2.22.4, and 2.23.0–2.23.5.
- Derivable WebDAV lock tokens can hijack cached authenticated sessions.
- CVEs
- CVE-2026-92414
- Vendors
- Apache Software Foundation
- Products
- Apache Jackrabbit
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92414 | Session fixation in Apache Jackrabbit WebDAV | 9.3 | — |
From the original article
Posted by Julian Reschke on Oct 07 Severity: CVSS 4. 0: 9. 3 (critical) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.