Critical 9.3Published Oct 7, 2026

CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

Updated under an hour ago (2026-10-19 09:50 UTC)

Does this affect you?

It affects Apache Software Foundation Apache Jackrabbit and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.73%, higher than 53% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Jackrabbit

Exploited in the last 30 days

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-384
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.73% (percentile 53)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache Jackrabbit apache_software_foundation:apache_jackrabbit (from the name)	from 2.23.0 through 2.23.5; from 2.22.0 through 2.22.4; from 2.20.0 through 2.20.17	CNA record
apache jackrabbit apache:jackrabbit	from 2.20.0 before 2.20.18; from 2.22.0 before 2.22.5; from 2.23.0 before 2.23.6	NVD

References

https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qrvendor-advisory, mailing-list
http://www.openwall.com/lists/oss-security/2026/10/07/27mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.