CRITICAL 9.3 NVD
CVE-2026-92414
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any L
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
References
- https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr
- http://www.openwall.com/lists/oss-security/2026/10/07/27
- https://www.openwall.com/lists/oss-security/2026/10/07/27
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-07 via NVD.
Risk Timeline
CVE Disclosed2026-10-07 · 4 days ago
Remediation Resources
Official Advisory
www.openwall.com/lists/oss-security/2026/10/07/27Official Advisory
www.openwall.com/lists/oss-security/2026/10/07/27
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.