org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=3.0.0-m0, <=4.0.7) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =4.0.7 Source cves: CVE-2026-78336 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTOIDCC4UI-20186775...

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=4.1.0-m0, <=4.1.2) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-78336 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTOIDCC4UI-20186775...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the OIDC provider list process. An attacker can obtain sensitive configuration data, including client secrets, by querying the list of available OIDC providers as any authenticated...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core:syncope-core-persistence-jpa (>=4.1.0-m0, <=4.1.2) +13 more potentially affected by CVE-2026-73579 via org.apache.syncope.core:syncope-core-persistence-common (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-persistence-common MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0,...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73370 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186790...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73370 Source advisory: MEND:CVE-2026-73370...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-73668 Source advisory: MEND:CVE-2026-73668...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: MEND:CVE-2026-73668...

CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=4.1.0-m0, <=4.1.2) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-78336 Source advisory: MEND:CVE-2026-78336...

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=4.0.0-m0, <=4.0.7) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-78336 Source advisory: MEND:CVE-2026-78336...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62418 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-19352416...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62418 Source advisory: MEND:CVE-2026-62418...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.0, <=4.0.3), org.apache.syncope.client.idm:syncope-client-idm-console (>=4.0.0, <=4.0.3) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=4.0.0, <=4.0.3)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-23795 Source advisory: OSV:GHSA-73F3-RQQF-2J54...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0, <=3.0.15), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0, <=3.0.15) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0, <=3.0.15)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.15 Source cves: CVE-2026-23795 Source advisory: GHSA-73F3-RQQF-2J54...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.0, <=4.0.3), org.apache.syncope.client.idm:syncope-client-idm-console (>=4.0.0, <=4.0.3) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=4.0.0, <=4.0.3)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-23795 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECLIENTIDREPO-15202477...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0, <=3.0.15), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0, <=3.0.15) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0, <=3.0.15)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.15 Source cves: CVE-2026-23795 Source advisory: MEND:CVE-2026-23795...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.0, <=4.0.3), org.apache.syncope.client.idm:syncope-client-idm-console (>=4.0.0, <=4.0.3) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=4.0.0, <=4.0.3)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-23795 Source advisory: MEND:CVE-2026-23795...