CVE-2026-92414: Apache Jackrabbit WebDAV Session Fixation via Derivable Lock Tokens

CVE-2026-92414 is a session-fixation and session-reuse vulnerability in Apache Jackrabbit's WebDAV server, the Java content-repository implementation used as the storage layer behind products like Adobe Experience Manager, where the server attaches a cached, already-authenticated session to any request that happens to present a matching Lock-Token, TransactionId, SubscriptionId, or If-header token — without checking that the requester actually owns or authenticated that session, letting an attacker who can derive a valid token hijack another user's session before ever logging in.

CVE-2026-92414 (CWE-384, Session Fixation) affects Apache Jackrabbit, the Apache Software Foundation's reference implementation of the Java Content Repository (JCR) API, widely embedded as the storage engine behind Adobe Experience Manager and other content-management platforms. NVD's description states: "Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17" (NVD). WebDAV locking protocol uses opaque lock tokens to identify who holds a lock on a resource; Jackrabbit's server-side handling treats a token match alone as proof of ownership of the cached session tied to that token, rather than independently verifying the requester's credentials.

NVD's own analysis assigns a Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-reachable, low complexity, no privileges or user interaction required. The Apache Software Foundation's own CNA submission scores it under CVSS v4.0 instead, at 9.3 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N — materially consistent with NVD's v3.1 rating despite the different scoring standard, both converging on critical-severity, no-privilege, no-interaction exploitation (GitHub Advisory Database GHSA-3mf8-5fj8-p748).

The Apache Jackrabbit project's own security announcement, sent to the [email protected] list by PMC member Julian Reschke on 2026-10-07 under the subject "CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens," confirms the CVSS 4.0 9.3 critical rating, lists the same three affected version ranges as NVD, and states: "Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue." The announcement credits the Apache Software Foundation as finder, Julian Reschke as analyst, and "Claude Security" as the tool that surfaced the issue (Apache Jackrabbit security announcement, lists.apache.org).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00725 (53.5th percentile) — comparatively higher than many bugs in this batch, consistent with a pre-authentication session-hijack path with no privilege requirement (FIRST EPSS). CVE-2026-92414 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Any deployment running Apache Jackrabbit's WebDAV server in the affected 2.20.x, 2.22.x, or 2.23.x lines — including products like Adobe Experience Manager that embed Jackrabbit as their repository layer — should upgrade to 2.23.6, 2.22.5, or 2.20.18 as appropriate; the project's announcement documents no workaround short of the version upgrade.

• Apache Jackrabbit's WebDAV server attaches a cached authenticated session to any request matching a Lock-Token, TransactionId, SubscriptionId, or If-header field token, with no credential check, affecting versions 2.23.0-2.23.5, 2.22.0-2.22.4, and 2.20.0-2.20.17. — NVD
• NVD Primary CVSS v3.1 base score is 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); the Apache Software Foundation's own CNA submission scores it under CVSS v4.0 at 9.3 critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N), both converging on critical with no privileges or interaction required. — GitHub Advisory Database
• Apache Jackrabbit security announcement (lists.apache.org, 2026-10-07, subject "Pre-auth hijack of cached sessions via derivable WebDAV lock tokens") confirms CVSS 4.0 9.3 critical, lists the same affected ranges, and recommends upgrading to 2.23.6, 2.22.5, or 2.20.18. — Apache Jackrabbit security announcement
• EPSS score is 0.00725 (53.5th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS