CVE-2026-92414
Received Received - Intake

Session Fixation in Apache Jackrabbit

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Apache Software Foundation

Description
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-92414
EUVD
EUVD-2026-94406

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Jackrabbit 2.23.0
Apache Software Foundation Apache Jackrabbit 2.22.0
Apache Software Foundation Apache Jackrabbit 2.20.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Session Fixation / Session Reuse vulnerability in Apache Jackrabbit. The WebDAV server attaches a cached authenticated session when certain header tokens match without verifying credentials. This allows unauthorized session reuse across different users.

Detection Guidance

This vulnerability involves session fixation in Apache Jackrabbit's WebDAV server. Detection requires checking the version of Apache Jackrabbit. Run commands like 'curl -s http://your-server/jackrabbit/status.jsp' or check the server logs for WebDAV requests. Affected versions are 2.20.0-2.20.17, 2.22.0-2.22.4, and 2.23.0-2.23.5.

Impact Analysis

An attacker could hijack authenticated sessions by exploiting session reuse, gaining unauthorized access to sensitive data or performing actions on behalf of other users. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability could violate GDPR's requirement for secure processing and user consent, as unauthorized session access may expose personal data. It may also breach HIPAA's access controls for protected health information if exploited.

Mitigation Strategies

Upgrade Apache Jackrabbit to fixed versions: 2.20.18, 2.22.5, or 2.23.6. If upgrading is not immediately possible, disable the WebDAV server component or restrict access to trusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92414. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart