As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass
CVE-2026-87802 affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The vulnerability involves improper verification of cryptographic signatures in the Syncope Secure Request Adapter (SRA) when configured for OAuth 2.0 without a JSON Web Key Set (JWKS) URI, allowing attackers to forge signatures. The issue is rated low severity.
Why it matters: Organizations deploying Apache Syncope as an SRA with OAuth 2.0 authentication and no JWKS endpoint configured need to update immediately, as forged signatures could bypass authentication controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass
CVE-2026-87802 is a signature verification bypass vulnerability in Apache Syncope's secure remote access (SRA) OAuth 2.0 implementation affecting versions 3.0.0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS URI, attackers can forge JSON Web Tokens (JWT) to bypass authentication.
Why it matters: Organizations running affected Apache Syncope versions with OAuth 2.0 enabled and no JWKS URI configured face unauthorized access risk; verify your SRA configuration and apply patches to affected branches immediately.
- Source published
- First seen by Cybersecurity Tracker