CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/07/27	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:jackrabbit::::::::
	cpe:2.3:a:apache:jackrabbit::::::::
	cpe:2.3:a:apache:jackrabbit::::::::

History

13 Oct 2026, 14:24

Type	Values Removed	Values Added
References	~~() https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr -~~	() https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr - Mailing List, Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2026/10/07/27 -~~	() http://www.openwall.com/lists/oss-security/2026/10/07/27 - Mailing List, Third Party Advisory
CPE		cpe:2.3:a:apache:jackrabbit::::::::
First Time		Apache Apache jackrabbit
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1

07 Oct 2026, 17:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/07/27 -

07 Oct 2026, 16:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-07 16:19

Updated : 2026-10-13 14:24

NVD link : CVE-2026-92414

Mitre link : CVE-2026-92414

CVE.ORG link : CVE-2026-92414

JSON object : View

Products Affected

apache

jackrabbit

CWE

CWE-384

Session Fixation

{"id": "CVE-2026-92414", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92414", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T20:29:09.750450Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Jackrabbit", "versions": [{"status": "affected", "version": "2.23.0", "versionType": "semver", "lessThanOrEqual": "2.23.5"}, {"status": "affected", "version": "2.22.0", "versionType": "semver", "lessThanOrEqual": "2.22.4"}, {"status": "affected", "version": "2.20.0", "versionType": "semver", "lessThanOrEqual": "2.20.17"}], "packageURL": "pkg:maven/org.apache.jackrabbit/jackrabbit-jcr-server", "packageName": "org.apache.jackrabbit:jackrabbit-jcr-server", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-10-07T16:19:12.900", "references": [{"url": "https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/07/27", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": ": Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.\n\n\n\nJackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with\n\nno credential check.\n\n\n\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue."}], "lastModified": "2026-10-13T14:24:57.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED33B3AA-CC33-415A-9B7D-3AEA9E13996D", "versionEndExcluding": "2.20.18", "versionStartIncluding": "2.20.0"}, {"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC45EF0E-2A77-4858-866D-1FE0E7C19241", "versionEndExcluding": "2.22.5", "versionStartIncluding": "2.22.0"}, {"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9376FC7D-3C7E-4147-96FF-D63A7AAF2C60", "versionEndExcluding": "2.23.6", "versionStartIncluding": "2.23.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}