Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the OIDC provider list process. An attacker can obtain sensitive configuration data, including client secrets, by querying the list of available OIDC providers as any authenticated...

CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...