CVE-2026-92414

Summary

This vulnerability allows attackers to hijack authenticated sessions in Apache Jackrabbit by reusing session tokens without proper credential verification, enabling unauthorized access to user sessions. This is particularly dangerous because it can lead to full system compromise through session fixation attacks.

Exploitability

Exploitation requires an attacker to obtain a valid Lock-Token/TransactionId/SubscriptionId/If-header token from a legitimate session and then reuse it, with minimal technical prerequisites beyond access to the WebDAV interface.

Blast radius

The impact could be significant across all authenticated users of affected Jackrabbit versions, potentially allowing attackers to access sensitive content, perform unauthorized operations, and maintain persistent access through reused sessions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Jackrabbit versions 2.23.6, 2.22.5, or 2.20.18 which contain the fix for this session fixation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.