EUVD-2026-77438

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...

CVE-2026-78330

Apache Syncope is affected by an incorrect privilege assignment vulnerability in its internal JWT authentication mechanism. When the configured JWKS settings (at least protocol and key) are disclosed, an attacker who completes a successful authentication and obtains a valid low-privilege JWT can ...

CVE-2026-87785

Apache Syncope contains an authentication bypass vulnerability in its internal JWT authentication mechanism. When the configured JWKS settings (at least the protocol and key) are disclosed, an attacker who has completed a successful authentication and obtained a valid JWT can spoof another user's...

EUVD-2026-77368

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...

PT-2026-91180

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...