9.1

CVE-2026-87802

Apache Syncope: SRA OAuth2 JWT signature verification bypass

Improper verification of cryptographic signature vulnerability in Apache Syncope.



When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.



Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerApache Software Foundation
≫
Produkt Apache Syncope
Default Statusunaffected
Version <= 3.0.16
Version 3.0.0-M0
Status affected
Version <= 4.0.7
Version 4.0.0-M0
Status affected
Version <= 4.1.2
Version 4.1.0-M0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.175
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://lists.apache.org/thread/gx83cootj00kn8hqd73x1bp8441np33d
http://www.openwall.com/lists/oss-security/2026/09/14/25