CVE-2026-87785

A vulnerability in Apache Syncope allows for an authentication bypass by spoofing. If the configured JWKS settings for internal JWT authentication (specifically the protocol and key) are disclosed, an attacker can spoof another user's privileges after successfully authenticating and obtaining a v...