{"id":"CVE-2026-92414","published":"2026-10-07T16:19:12.900","lastModified":"2026-10-13T14:24:57.127","description":": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.\n\n\n\nJackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with\n\nno credential check.\n\n\n\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-384"],"vendors":["apache"],"products":["jackrabbit"],"references":[{"url":"https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/27","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to hijack authenticated sessions in Apache Jackrabbit by reusing session tokens without proper credential verification, enabling unauthorized access to user sessions. This is particularly dangerous because it can lead to full system compromise through session fixation attacks.","exploitability":"Exploitation requires an attacker to obtain a valid Lock-Token/TransactionId/SubscriptionId/If-header token from a legitimate session and then reuse it, with minimal technical prerequisites beyond access to the WebDAV interface.","blast_radius":"The impact could be significant across all authenticated users of affected Jackrabbit versions, potentially allowing attackers to access sensitive content, perform unauthorized operations, and maintain persistent access through reused sessions.","remediation":"Upgrade to Apache Jackrabbit versions 2.23.6, 2.22.5, or 2.20.18 which contain the fix for this session fixation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["session-fixation","webdav","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:54.684Z"}}