As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-78336 is a moderate severity vulnerability in Apache Syncope's OpenID Connect for User Interface (OIDCC4UI) provider that discloses client secrets to any authenticated user through the provider list endpoint. The flaw affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Organizations running these versions should apply patches to prevent unauthorized exposure of sensitive credentials.
Why it matters: Syncope administrators and operators of affected deployments must prioritize patching to prevent authenticated users from extracting OpenID Connect client secrets, which could enable account takeover and lateral movement in federated identity environments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-78336 is an information disclosure vulnerability in Apache Syncope's OpenID Connect provider (OIDCC4UI) component that exposes client secrets to any authenticated user. The flaw affects versions 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.2. The vulnerability has a CVSS score of 7.5.
Why it matters: Organizations running affected Apache Syncope versions with OIDCC4UI enabled should audit for exposure of OpenID Connect client secrets and plan patching, as authenticated users can retrieve credentials needed to impersonate applications.
- Source published
- First seen by Cybersecurity Tracker