CVE-2026-87785

Apache Syncope contains an authentication bypass vulnerability in its internal JWT authentication mechanism. When the configured JWKS settings (at least the protocol and key) are disclosed, an attacker who has completed a successful authentication and obtained a valid JWT can spoof another user's...