Vulnerability Details CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 48.3%
CVSS Severity
CVSS v3 Score 9.1
References
Products affected by CVE-2026-92414
-
cpe:2.3:a:apache:jackrabbit:2.20.0
-
cpe:2.3:a:apache:jackrabbit:2.20.1
-
cpe:2.3:a:apache:jackrabbit:2.20.10
-
cpe:2.3:a:apache:jackrabbit:2.20.11
-
cpe:2.3:a:apache:jackrabbit:2.20.12
-
cpe:2.3:a:apache:jackrabbit:2.20.13
-
cpe:2.3:a:apache:jackrabbit:2.20.14
-
cpe:2.3:a:apache:jackrabbit:2.20.15
-
cpe:2.3:a:apache:jackrabbit:2.20.16
-
cpe:2.3:a:apache:jackrabbit:2.20.17
-
cpe:2.3:a:apache:jackrabbit:2.20.2
-
cpe:2.3:a:apache:jackrabbit:2.20.3
-
cpe:2.3:a:apache:jackrabbit:2.20.4
-
cpe:2.3:a:apache:jackrabbit:2.20.5
-
cpe:2.3:a:apache:jackrabbit:2.20.6
-
cpe:2.3:a:apache:jackrabbit:2.20.7
-
cpe:2.3:a:apache:jackrabbit:2.20.8
-
cpe:2.3:a:apache:jackrabbit:2.20.9
-
cpe:2.3:a:apache:jackrabbit:2.23.0
-
cpe:2.3:a:apache:jackrabbit:2.23.1
-
cpe:2.3:a:apache:jackrabbit:2.23.2