Apache Jackrabbit CVE-2026-92414

Requires a running Apache Jackrabbit WebDAV server reachable by the attacker. Exploitation is triggered when a request carries a Lock-Token, TransactionId, SubscriptionId, or If-header field token value that matches a token tied to a cached authenticated session on the server; on any such match the server reuses that authenticated session with no credential check. The practical limiting factor is obtaining or guessing a token value that currently maps to an active cached session - exploitation depends on a valid in-cache token existing and being presentable by the attacker. Affects only versions 2.23.0-2.23.5, 2.22.0-2.22.4, and 2.20.0-2.20.17; patched releases remove the behavior. No user interaction or authentication of the attacker is required per the vendor CVSS.

This is a genuine high-priority issue, not an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.3) indicates fully remote, unauthenticated exploitation with low complexity and high confidentiality and integrity impact, which is consistent with the described flaw: the Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header token match without a credential check (CWE-384 Session Fixation / session reuse across users). No EPSS score, CISA KEV listing, or POC was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' - the elevated CVSS reflects potential impact, not confirmed activity. One point of tension to verify: the CVSS claims AC:L, but reuse hinges on presenting a token value that matches a session currently cached server-side; if those tokens are not readily observable or predictable, real-world attack complexity may be higher than AC:L implies. Reported by Apache itself with fix versions published, so the vulnerability and remediation are well-attested even though real-world exploitation signals are absent.

An attacker sends WebDAV requests to a vulnerable Jackrabbit server supplying a Lock-Token, TransactionId, SubscriptionId, or If-header token value that matches one cached from a legitimate authenticated user; the server attaches that user's authenticated session to the attacker's request without any credential check. The attacker then reads or modifies repository content as the impersonated user over the network without authentication. No public exploit code was identified in the provided data, but the described mechanism is low-complexity given a matching token.