CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

Q: What must an attacker provide to reuse an authenticated session?

The attacker needs a matching token in a WebDAV Lock-Token, TransactionId, SubscriptionId, or If header. The server attaches the cached authenticated session when one of those tokens matches, without checking credentials.

Q: Is authentication or user interaction required for exploitation?

No. The CVSS vector specifies no privileges required and no user interaction, and the issue is described as occurring without a credential check.

Q: Which releases should be deployed to remediate the issue?

Upgrade affected 2.23.x deployments to 2.23.6, affected 2.22.x deployments to 2.22.5, or affected 2.20.x deployments to 2.20.18. The affected ranges are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17.

Published Oct 7, 2026

Updated

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with

no credential check.

This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.

Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Affected Software

1 affected component

Apache jackrabbit>=2.23.0<=2.23.5, >=2.22.0<=2.22.4, >=2.20.0<=2.20.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Jackrabbit to a version that resolves this vulnerability.
Fixed in 2.23.6
Upgrade
Upgrade Apache Jackrabbit to a version that resolves this vulnerability.
Fixed in 2.22.5
Upgrade
Upgrade Apache Jackrabbit to a version that resolves this vulnerability.
Fixed in 2.20.18

Event History

Oct 7, 2026

CVE Published

via MITRE·03:46 PM

Data Sourced

via MITRE·03:46 PM

DescriptionWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to reuse an authenticated session?

The attacker needs a matching token in a WebDAV Lock-Token, TransactionId, SubscriptionId, or If header. The server attaches the cached authenticated session when one of those tokens matches, without checking credentials.

Is authentication or user interaction required for exploitation?

No. The CVSS vector specifies no privileges required and no user interaction, and the issue is described as occurring without a credential check.

Which releases should be deployed to remediate the issue?

Upgrade affected 2.23.x deployments to 2.23.6, affected 2.22.x deployments to 2.22.5, or affected 2.20.x deployments to 2.20.18. The affected ranges are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17.

CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker provide to reuse an authenticated session?

Is authentication or user interaction required for exploitation?

Which releases should be deployed to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to reuse an authenticated session?

Is authentication or user interaction required for exploitation?

Which releases should be deployed to remediate the issue?