As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
Apache Jackrabbit contains a session fixation vulnerability in its WebDAV server that allows attackers to reuse cached authenticated sessions via derivable lock tokens without authentication. The issue affects versions 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, with a CVSS score of 9.3 (critical).
Why it matters: Organizations running affected Jackrabbit versions face immediate risk of unauthorized session hijacking and data access; patching or upgrading to fixed versions is required today.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
CVE-2026-92414 affects Apache Jackrabbit versions 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17, enabling unauthenticated attackers to hijack cached sessions through derivable WebDAV lock tokens. The vulnerability allows session fixation and reuse across different users, with a CVSS 4.0 score of 9.3 (critical severity). Patched versions address this pre-authentication session management flaw.
Why it matters: Organizations running unpatched Jackrabbit versions face critical risk of unauthorized access and session takeover without requiring authentication, requiring immediate patching.
- Source published
- First seen by Cybersecurity Tracker