Authentication Bypass Vulnerability in Apache Syncope by Apache
CVE-2026-87785

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
14 September 2026

What is CVE-2026-87785?

This vulnerability allows attackers to spoof user privileges by disclosing the configured JWKS settings for internal JWT authentication. After successfully authenticating and obtaining a valid JWT, malicious actors can exploit this flaw to impersonate other users, potentially compromising sensitive data and system integrity. It affects specific versions of Apache Syncope, making immediate upgrades to versions 4.0.8 or 4.1.3 essential for ensuring security.

Affected Version(s)

Apache Syncope 3.0.0-M0 <= 3.0.16

Apache Syncope 4.0.0-M0 <= 4.0.7

Apache Syncope 4.1.0-M0 <= 4.1.2

References

https://lists.apache.org/thread/3t3om8mny7ng52q053pdzpmtd...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alon Galili
.