CVE-2026-92414

A flaw was found in jackrabbit-webdav. The WebDAV Web Distributed Authoring and Versioning server attaches a cached authenticated session when request header tokens—such as lock, transaction, or subscription identifiers—match, without verifying user credentials. An unauthenticated remote attacker...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.2.4) +24 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-webdav (>=2.20.0, <=2.20.17)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =8.1.0.583.6, =8.1.0.583.6, =2.18.0, =2.18.0, =2.18.0, =3.4.8, =3.7.0, =3.7.0, =3.4.2, =3.4.2, =4.0.0 and more Source cves: CVE-2026-92414 Source advisory: SNYK:JAVA-ORGAPACHEJACKRABBIT-2087750...

cn.net.pap:pap4j-common-webdav (>=0.0.2, <=0.0.3), com.day.crx:crx-server (>=2.3.0-alpha1, <=2.3.5) +7 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-webdav (>=2.23.1-beta, <=2.23.6-beta)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.23.1-beta, =0.0.2, =2.3.0-alpha1, =2.3.0-alpha1, =2.23.1-beta, =2.23.1-beta, =2.23.1-beta, =2.23.1-beta, =2.23.1-beta, =2.0.0-alpha6, =2.0.0-beta2 Source cves: CVE-2026-92414 Source advisory: SNYK:JAVA-ORGAPACHEJACKRABBIT-20877502...

Session Fixation

Overview org.apache.jackrabbit:jackrabbit-webdav is a Generic WebDAV Library Affected versions of this package are vulnerable to Session Fixation in the WebDAV authentication process due to the server attaching a cached authenticated session to any matching Lock-Token, TransactionId,...

biz.netcentric.cq.tools.accesscontroltool:sling-maximum-version-environment (>=4.2.0, <=4.2.4), cn.net.pap:pap4j-common-webdav (0.0.4) +16 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-webdav (>=2.22.0, <=2.22.4)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.22.0, =4.2.0, =4.0.0, =4.1.4, =2.22.0, =2.22.0, =2.22.0, =2.22.0, =2.22.0, =1.66.0, =2.6.0 - org.apache.sling:org.apache.sling.jcr.davex 1.3.14 - org.apache.sling:org.apache.sling.starter.integration-tests 14 -...

Linux Distros Unpatched Vulnerability : CVE-2016-6801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6,...

org.apache.archiva:archiva-webapp (>=1.4-m4, <=2.0.1), org.apache.archiva:archiva-webdav (>=1.4-m4, <=2.0.1) +13 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.6.0, <=2.6.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.6.0, =1.4-m4, =1.4-m4, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =1.2.2, =2.2.2, =1.3.0-beta3, =1.0.0-beta1, =1.2.0-cr9, =1.3.0-beta2 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

org.apache.archiva:archiva-webapp (>=1.4-m4, <=2.0.1), org.apache.archiva:archiva-webdav (>=1.4-m4, <=2.0.1) +13 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.6.0, <=2.6.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.6.0, =1.4-m4, =1.4-m4, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =1.2.2, =2.2.2, =1.3.0-beta3, =1.0.0-beta1, =1.2.0-cr9, =1.3.0-beta2 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

net.adamcin.recap:net.adamcin.recap.addressbook (>=0.8.0, <=1.0.1), net.adamcin.recap:net.adamcin.recap.core (>=0.8.0, <=1.0.1) +16 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.4.0, <=2.4.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.4.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.1.0, =2.1.2, =5.12.0, =5.11.0, =5.12.2 and more Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

net.oneandone.cosmo:cosmo-core (>=1.3.0, <=3.2.4), org.apache.jackrabbit:jackrabbit-bundle (>=2.13.0, <=2.13.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.13.0, <=2.13.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.13.0, =1.3.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.2 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

net.adamcin.recap:net.adamcin.recap.addressbook (>=0.8.0, <=1.0.1), net.adamcin.recap:net.adamcin.recap.core (>=0.8.0, <=1.0.1) +16 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.4.0, <=2.4.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.4.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.1.0, =2.1.2, =5.12.0, =5.11.0, =5.12.2 and more Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

com.khubla.com.pragmatach.examples:jcrexample (1.40), com.khubla.pragmatach:pragmatach-jcr (1.40) +15 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.8.0, <=2.8.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.8.0, =2.1.0, =2.1.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =1.0.9, =1.0, =0.9.5, =5.13.1, =5.13.1, =5.22.7 and more Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

com.khubla.com.pragmatach.examples:jcrexample (1.40), com.khubla.pragmatach:pragmatach-jcr (1.40) +15 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.8.0, <=2.8.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.8.0, =2.1.0, =2.1.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =1.0.9, =1.0, =0.9.5, =5.13.1, =5.13.1, =5.22.7 and more Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

net.oneandone.cosmo:cosmo-core (>=1.3.0, <=3.2.4), org.apache.jackrabbit:jackrabbit-bundle (>=2.13.0, <=2.13.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.13.0, <=2.13.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.13.0, =1.3.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.2 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

Apache Jackrabbit Authentication Hijacking Vulnerability

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...

org.apache.jackrabbit:jackrabbit-bundle (>=2.12.0, <=2.12.3), org.apache.jackrabbit:jackrabbit-jcr-server (>=2.12.0, <=2.12.3) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.12.0, <=2.12.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =1.3.2, =1.3.4 - org.apache.sling:org.apache.sling.jcr.webdav 2.3.4 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

org.apache.jackrabbit:jackrabbit-bundle (>=2.12.0, <=2.12.3), org.apache.jackrabbit:jackrabbit-jcr-server (>=2.12.0, <=2.12.3) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.12.0, <=2.12.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =1.3.2, =1.3.4 - org.apache.sling:org.apache.sling.jcr.webdav 2.3.4 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

DEBIAN-CVE-2016-6801

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...