As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-87785: Apache Syncope: JWT subject spoofing
CVE-2026-87785 is a low-severity authentication bypass vulnerability in Apache Syncope that allows JWT subject spoofing when JWKS settings for internal JWT authentication are misconfigured. The flaw affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 of the syncope-core-spring component. Patches and mitigations are available from the Apache Syncope project.
Why it matters: Organizations running vulnerable Syncope versions with JWT-based authentication need to verify their JWKS configuration and apply patches to prevent attackers from spoofing JWT subjects and bypassing authentication controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-87785: Apache Syncope: JWT subject spoofing
CVE-2026-87785 is a JWT subject spoofing vulnerability in Apache Syncope affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The flaw allows authentication bypass when JWKS settings for internal JWT authentication are misconfigured.
Why it matters: Organizations running Apache Syncope must patch affected versions to prevent attackers from spoofing JWT subjects and bypassing authentication controls on identity and access services.
- Source published
- First seen by Cybersecurity Tracker