CVE-2026-92414 is a session reuse flaw in the Apache Jackrabbit WebDAV server, rated 9.1. It attaches a cached authenticated session when a request carries a matching token, without checking credentials. Upgrade to 2.23.6, 2.22.5 or 2.20.18, depending on your release line.
What's affected
- Product: Apache Jackrabbit, the content repository, in its WebDAV server.
- Affected: 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17.
- Fixed: 2.23.6, 2.22.5 and 2.20.18.
- Trigger: the server matches lock, transaction or subscription tokens, including tokens in the If header, to a cached session with no credential check.
How to check if you're exposed
Find which Jackrabbit version your application bundles. The WebDAV server code lives in Jackrabbit modules such as jackrabbit-webdav and jackrabbit-jcr-server, so look for those.
mvn dependency:tree | grep -i jackrabbit
./gradlew dependencies | grep -i jackrabbit
If you ship a WAR or a fat JAR, list its libraries and look for jackrabbit jars with the versions above. Then check whether the WebDAV endpoint is reachable by users who are not meant to use it.
What to do now
- Upgrade to the fixed version for your line: 2.23.6, 2.22.5 or 2.20.18.
- Rebuild and redeploy every application that bundles Jackrabbit, not only the ones you know use WebDAV.
- Restrict the WebDAV endpoint to the networks and users that need it while you roll out the update.
- Review access logs for WebDAV requests that carry lock or transaction tokens from clients that never authenticated.
- Recheck your dependency scan so the old versions no longer show up.
Why it matters
The record lists CWE-384, session fixation, and describes the problem as session reuse across users. Tokens such as lock tokens are meant to identify an operation, not a person. If the server treats a matching token as proof of identity and hands over the session that created it, whoever presents that token gets that session's rights.
The vector is network based with no privileges and no user interaction, and scores high for confidentiality and integrity. The oss-security announcement from the Apache project describes the issue as a pre-authentication hijack of cached sessions through derivable WebDAV lock tokens. The record does not mark it as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect me if I only use Jackrabbit for storage and not WebDAV?
The flaw is in the WebDAV server. If that code is not deployed or reachable, your exposure is much lower, but upgrading is still the clean fix because it can be bundled without you noticing.
Sources
Last reviewed: 19 October 2026.
