The vulnerability allows an unauthenticated user to hijack an existing authenticated session by using an attacker‑derived WebDAV lock token. The session is reused across users without a credential check, enabling an attacker to perform actions as another user. This results in potential compromise of confidentiality, integrity, and availability of the Jackrabbit repository.

The affected product is Apache Jackrabbit from the Apache Software Foundation. Versions 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17 are impacted. Users should upgrade to 2.23.6, 2.22.5, or 2.20.18 to receive the fix.

The CVSS score of 9.3 indicates critical severity. The EPSS score of <1% (approximately 0.6%) indicates a low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The lack of a required authentication step and the ability to derive lock tokens from publicly available information suggest a practical exploitation path. The likely attack vector is a crafted WebDAV request that includes a Lock‑Token, TransactionId, SubscriptionId, or If‑Header that matches a cached session, bypassing the credential check and allowing session reuse across users.