Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87802— Apache Syncope: SRA OAuth2 JWT signature verification bypass

Quick assessment

Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Syncope 中加密签名验证不当漏洞 当 SRA 配置为 OAuth 2.0 但未设置 JWKS 地址（JWKS set URI）时，攻击者可以伪造任意 JWT 令牌，从而冒充任意用户身份和权限，进而获取对 SRA 代理服务的完全访问权限。 该问题影响以下版本的 Apache Syncope： 3.0.0-M0 至 3.0.16 4.0.0-M0 至 4.0.7 4.1.0-M0 至 4.1.2 建议用户升级到 4.0.8 或 4.1.3 版本，这些版本已修复此问题。

AI Predicted 9.8 Difficulty: Easy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87802

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Syncope: SRA OAuth2 JWT signature verification bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Syncope 3.0.0-M0 ~ 3.0.16 -

II. Public POCs for CVE-2026-87802

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87802

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-87802 (1)

Same Patch Batch · Apache Software Foundation · 2026-09-14 · 24 CVEs total

CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr
CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access
CVE-2026-87785 Apache Syncope: JWT subject spoofing
CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output
CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search
CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication
CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui
CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective
CVE-2026-73191 Apache Syncope: CAS service URL injection via Forwarded HTTP headers
CVE-2026-73668 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
CVE-2026-75030 Apache Syncope: Incomplete authorization checks for Group members deprovisioning
CVE-2026-75015 Apache Syncope: Nested secrets leak cleartext into audit records readable
CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions
CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles
CVE-2026-73178 Apache Syncope: JWT Access Token takeover

Showing top 20 of 24 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Syncope
Same vendor: Apache Software Foundation
Same weakness: CWE-347

V. Comments for CVE-2026-87802

No comments yet

Leave a comment