Apache Jackrabbit WebDAV server: Session reuse across users
Summary
Apache Jackrabbit, a Java content repository, has a flaw in its WebDAV server: a cached authenticated session is attached to a request when a Lock-Token, TransactionId, SubscriptionId or If header value matches, without any credential check. An unauthenticated remote attacker who can derive a matching token can act within another user's session, which can seriously affect confidentiality and integrity. Applications that embed Jackrabbit may be affected as well.
Affected
- Apache Jackrabbit 2.23.0 through 2.23.5
- Apache Jackrabbit 2.22.0 through 2.22.4
- Apache Jackrabbit 2.20.0 through 2.20.17
- Affected component: WebDAV server (jackrabbit-jcr-server; confirm the artifact in your dependency tree)
- Default configuration: unaffected according to the CNA record
Fixed in
- Apache Jackrabbit 2.23.6 (labelled beta by Apache according to secondary sources)
- Apache Jackrabbit 2.22.5
- Apache Jackrabbit 2.20.18
Workaround
Unknown. No vendor workaround found in the reviewed sources. Interim measure (not from the vendor): restrict access to Jackrabbit WebDAV endpoints via VPN, IP allow-lists or reverse-proxy rules until patched.
Exploitation
- Apache reports no known active exploitation.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No public proof of concept found at the time of research.
- Presence in the CISA KEV catalogue: unverified.
Our recommendation
- Identify every Jackrabbit instance, including those embedded in applications such as CMS platforms, and record their versions.
- Update to 2.23.6, 2.22.5 or 2.20.18 as applicable; plan for a beta-labelled 2.23.6 if you run the 2.23 line.
- Until patched, restrict WebDAV endpoints to trusted networks and review logs for unexpected session reuse.
- Treat internet-facing instances as critical priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list advisory thread lists.apache.org
- oss-security post CVE-2026-92414 www.openwall.com
- LinuxSecurity: Apache Jackrabbit WebDAV session hijacking linuxsecurity.com
- OSV: UBUNTU-CVE-2026-92414 osv.dev
- CVE-2026-92414 at ThreatInt cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:03.
Original description (NVD)
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.