Skip to content
fr Sign in
9.3 Critical

CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit

Description

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Jackrabbit 2.23 2.23.0 → 2.23.5 No fix stated
Apache Jackrabbit 2.22 2.22.0 → 2.22.4 No fix stated
Apache Jackrabbit 2.20 2.20.0 → 2.20.17 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Jackrabbit

The 3 CVEs of Apache Jackrabbit →
CVE-2026-92415 — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client 6.9 Medium CVE-2025-53689 Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an… Not rated
Track this CVE