Apache Syncope Auth Bypass via JWKS Spoofing (v3.x, v4.0.x, v4.1.x)
CVE-2026-87785 Published on September 14, 2026
Apache Syncope: JWT subject spoofing
Authentication bypass by spoofing vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Vulnerability Analysis
CVE-2026-87785 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-87785
Want to know whenever a new CVE is published for Apache Syncope? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Syncope:- Version 3.0.0-M0, <= 3.0.16 is affected.
- Version 4.0.0-M0, <= 4.0.7 is affected.
- Version 4.1.0-M0, <= 4.1.2 is affected.