CVE-2026-87802

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2

Description Improper verification of cryptographic signatures occurs when Secure Remote Access (SRA) is configured for OAuth 2.0 without a JWKS set URI assigned. This flaw allows an attacker to forge arbitrary JSON Web Tokens (JWTs) to impersonate any user identity and permissions, granting full access to services proxied by SRA.

Recommendations Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8. Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8. Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3.