Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-92414

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
Back to all
CVE

CVE-2026-92414

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

​

Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with

no credential check.

​

This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.

​

​

​

​

​

​

Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.3
-
4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
0
-
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Related Resources

No items found.

References

http://www.openwall.com/lists/oss-security/2026/10/07/27, https://repo.maven.apache.org/maven2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92414.json, https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr, https://nvd.nist.gov/vuln/detail/CVE-2026-92414

Severity

9.1

CVSS Score
0
10

Basic Information

Base CVSS
9.1
EPSS Probability
0.00725%
EPSS Percentile
0.54119%
Introduced Version
66c73133c8b8a1fc374251ceab692f1d9b59225d,2.4.5,2.21.0,2.23.0-beta,1.6.0,1.2.1,1.0,1.6.1,1.5.0,1.0.9,0
Fix Available
f1830d0aeb113cd658407d66ec9974a3fb91b98d,2.20.18,2.22.5,2.23.6-beta

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading