EXPOSURES › CVE-2026-92414
CVE-2026-92414
CRITICALApache Jackrabbit WebDAV server reuses cached authenticated sessions across users without credential checks, enabling session fixation and reuse attacks.
The vulnerability allows an attacker to hijack a valid session and impersonate a user by matching header tokens without verifying credentials. DIB organizations must patch to versions 2.23.6, 2.22.5, or 2.20.18 immediately to prevent unauthorized access and maintain compliance with access control requirements.
Shame score — A critical session fixation flaw in a widely used content repository that lacks basic credential verification, allowing attackers to impersonate users without needing to steal passwords.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.