CVE-2026-87785criticalCWE-290

CVE-2026-87785: falha crítica em Apache Syncope

Apache Syncope: JWT subject spoofing

Publicada em

Seguir esta CVE+ Monitorar Apache Syncope

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.5%
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache Syncope
CVEs relacionadas — Apache Syncope

No mesmo produto, das mais perigosas para as menos.

CVE-2025-57738HIGHApache Syncope: Remote Code Execution by delegated administratorsEPSS 23.2%CVE-2018-1322—CVE-2018-1322EPSS 19.9%CVE-2018-1321—CVE-2018-1321EPSS 17.5%CVE-2018-17186—CVE-2018-17186EPSS 2.5%CVE-2026-23795MEDIUMApache Syncope: Console XXE on Keymaster parametersEPSS 2.0%CVE-2018-17184—CVE-2018-17184EPSS 1.2%