CVE-2026-92414

CriticalCVSS 9.1/10Last modified Oct 13, 2026

Description

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with

no credential check.

This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.

Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Jackrabbit	>= 2.23.0, <= 2.23.5; >= 2.22.0, <= 2.22.4; >= 2.20.0, <= 2.20.17

References

https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qrMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/07/27Mailing List, Third Party Advisory

Timeline

Published: Oct 7, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-924155.3— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV CVE-2026-924164.3A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the fi CVE-2026-924176.5A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.CVE-2026-924183.5A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of CVE-2026-924195.3WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in t CVE-2026-92425.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authenti CVE-2026-924203.8The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the re CVE-2026-924214.7The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modif CVE-2026-924226.5The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode str CVE-2026-924232.7The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own p CVE-2026-924246.8The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the im CVE-2026-924255.5The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation chec