CVE-2026-92414

A flaw was found in jackrabbit-webdav. The WebDAV Web Distributed Authoring and Versioning server attaches a cached authenticated session when request header tokens—such as lock, transaction, or subscription identifiers—match, without verifying user credentials. An unauthenticated remote attacker...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.2.4) +24 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-webdav (>=2.20.0, <=2.20.17)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =8.1.0.583.6, =8.1.0.583.6, =2.18.0, =2.18.0, =2.18.0, =3.4.8, =3.7.0, =3.7.0, =3.4.2, =3.4.2, =4.0.0 and more Source cves: CVE-2026-92414 Source advisory: SNYK:JAVA-ORGAPACHEJACKRABBIT-2087750...

biz.netcentric.cq.tools.accesscontroltool:sling-maximum-version-environment (>=4.2.0, <=4.2.4), cn.net.pap:pap4j-common-webdav (0.0.4) +16 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-webdav (>=2.22.0, <=2.22.4)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.22.0, =4.2.0, =4.0.0, =4.1.4, =2.22.0, =2.22.0, =2.22.0, =2.22.0, =2.22.0, =1.66.0, =2.6.0 - org.apache.sling:org.apache.sling.jcr.davex 1.3.14 - org.apache.sling:org.apache.sling.starter.integration-tests 14 -...

cn.net.pap:pap4j-common-webdav (>=0.0.2, <=0.0.3), com.day.crx:crx-server (>=2.3.0-alpha1, <=2.3.5) +7 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-webdav (>=2.23.1-beta, <=2.23.6-beta)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.23.1-beta, =0.0.2, =2.3.0-alpha1, =2.3.0-alpha1, =2.23.1-beta, =2.23.1-beta, =2.23.1-beta, =2.23.1-beta, =2.23.1-beta, =2.0.0-alpha6, =2.0.0-beta2 Source cves: CVE-2026-92414 Source advisory: SNYK:JAVA-ORGAPACHEJACKRABBIT-20877502...

Session Fixation

Overview org.apache.jackrabbit:jackrabbit-webdav is a Generic WebDAV Library Affected versions of this package are vulnerable to Session Fixation in the WebDAV authentication process due to the server attaching a cached authenticated session to any matching Lock-Token, TransactionId,...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

DEBIAN-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

DEBIAN-CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

UBUNTU-CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

UBUNTU-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415

The Apache Jackrabbit WebDAV/DavEx client is vulnerable to unsafe reflection when interacting with a malicious WebDAV/DavEx server or an intercepted connection. The root cause is that the client runs Class.forName and a (String)-constructor on server-controlled error bodies, allowing an attacker ...

EUVD-2026-94407

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

org.apache.jackrabbit.vault:org.apache.jackrabbit.vault (4.0.0), org.apache.jackrabbit.vault:org.apache.jackrabbit.vault.rcp (4.0.0) +6 more potentially affected by CVE-2026-92415 via org.apache.jackrabbit:jackrabbit-spi2dav (>=2.22.0, <=2.22.4)

org.apache.jackrabbit:jackrabbit-spi2dav MAVEN version =2.22.0, =4.0.0, =2.22.0, =2.22.0, =2.22.4 - org.apache.sling:org.apache.sling.starter.integration-tests 14 Source cves: CVE-2026-92415 Source advisory: MEND:CVE-2026-92415...