CVE-2026-87785
Apache Syncope: JWT subject spoofing
- State
- Published
- Severity
- 9.1 Critical
- Published
- Sep 14, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 9, 2026
Description
Authentication bypass by spoofing vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-290 Authentication bypass by spoofing
Affected Products
| Product | Versions |
|---|---|
Apache SyncopeApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.