CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

Jackrabbit

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

7. Okt 2026

Original bei Hersteller öffnen

Ausgewertete Quellen

Hersteller
https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr
Hinweis
http://www.openwall.com/lists/oss-security/2026/10/07/27
NVD
CVE-2026-92414