PT-2026-91153
CVE-2026-87802
·
تاريخ النشر
2026-09-14
·
تاريخ التحديث
2026-09-16
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Apache Syncope versions 3.0.0-M0 through 3.0.16
Apache Syncope versions 4.0.0-M0 through 4.0.7
Apache Syncope versions 4.1.0-M0 through 4.1.2
Description
Improper verification of cryptographic signatures occurs when Secure Remote Access (SRA) is configured for OAuth 2.0 without a JWKS set URI assigned. This flaw allows an attacker to forge arbitrary JSON Web Tokens (JWTs) to impersonate any user identity and permissions, granting full access to services proxied by SRA.
Recommendations
Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8.
Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8.
Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾