Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Apache Jackrabbit discloses two WebDAV flaws, CVSS 9.3 and 6.9

1 source · 2 articlesFirst reported Updated ()
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache Jackrabbit 2.20–2.23 releases are affected by a critical pre-auth WebDAV session hijack and a medium DavEx client class-loading flaw.

Apache disclosed two Jackrabbit WebDAV issues on 2026-10-07. CVE-2026-92414 is a pre-authentication session-fixation and session-reuse flaw that can let an unauthenticated attacker hijack cached authenticated sessions through derivable WebDAV lock tokens; it is rated CVSS 4.0 9.3 with high confidentiality and integrity impact, and the notice does not report exploitation in the wild. CVE-2026-92415 affects the DavEx client: a malicious DavEx server, or an attacker who can influence error responses, can cause the client to run Class.forName and a String constructor on server-controlled error bodies. That issue is rated CVSS 4.0 6.9 with low integrity impact only. Both flaws affect the same ranges: 2.20.0–2.20.17, 2.22.0–2.22.4, and 2.23.0–2.23.5. The two reports cover different CVEs and do not contradict each other.

Key facts
  • CVE-2026-92414 is a pre-authentication session-fixation and session-reuse flaw in Apache Jackrabbit WebDAV that lets unauthenticated attackers hijack cached authenticated sessions via derivable lock tokens.
  • CVE-2026-92414 is rated CVSS 4.0 9.3 (network, low complexity, no privileges, no user interaction, high confidentiality and integrity); the notice does not report exploitation in the wild.
  • CVE-2026-92415 is a medium flaw in the Jackrabbit DavEx/WebDAV client: a malicious server or attacker who can influence error responses can cause Class.forName and a String constructor on server-controlled error bodies.
  • CVE-2026-92415 is rated CVSS 4.0 6.9 (AV:N/AC:L/PR:N/UI:N), with low integrity impact only and no confidentiality or availability impact.
  • Both CVEs affect Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5.
  • Both advisories were posted to oss-security on 2026-10-07.
Analyze CVE-2026-92414 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-92414CVE-2026-92415
Vendors
Apache Software FoundationApache
Products
Apache Jackrabbit
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · 23d ago oss-securityFirst report

    CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

    CVE-2026-92414 lets unauthenticated attackers hijack cached Apache Jackrabbit WebDAV sessions and is rated CVSS 9.3.

  2. · 23d ago oss-security

    CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

    Apache Jackrabbit DavEx clients can load attacker-chosen classes from malicious WebDAV error bodies (CVE-2026-92415).

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-92414
+1 related CVE
CVE-2026-92415
Session fixation in Apache Jackrabbit WebDAV
9.3
group max
—