Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (Apache Software Foundation Apache Jackrabbit)

CVE-2026-92414
CRITICAL 9.3

At a glance

Source
NVD
EPSS
EPSS 0.73 % · percentile 54 ()
State
PUBLISHED
Published
Updated
Assigner
apache
NVD status
Analyzed

Search on…

Description

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 4.0CRITICAL 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Napache
CVSS 4.0CRITICAL 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · security@apache.org (Secondary)
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NNVD · nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Apache Software Foundation · Apache Jackrabbitaffected 2.23.0 ≤ 2.23.5 ; affected 2.22.0 ≤ 2.22.4 ; affected 2.20.0 ≤ 2.20.17

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD