CVE-2026-92414

CriticalCVSS 9.1/10Last modified Oct 13, 2026

Description

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with

no credential check.

This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.

Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-924155.3— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAVCVE-2026-924164.3A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the fiCVE-2026-924176.5A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.CVE-2026-924183.5A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code ofCVE-2026-924195.3WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in tCVE-2026-92425.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to AuthentiCVE-2026-924203.8The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the reCVE-2026-924214.7The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modifCVE-2026-924226.5The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode strCVE-2026-924232.7The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own pCVE-2026-924246.8The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the imCVE-2026-924255.5The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation chec
CVE-2026-92414: Critical severity, CVSS 9.1 | Vulnix