CVE-2026-78336

CVE-2026-78336 affects Apache Syncope , an identity management platform. The vulnerability is an insertion of sensitive information into sent data issue in the OIDC provider list endpoint used for SSO with Console and Enduser. Any authenticated user can query this endpoint and receive the full co...

CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...

CVE-2026-87802

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue...

CVE-2026-87779

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...

CVE-2026-87785

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...

CVE-2026-82232

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-86460

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fi...

CVE-2026-82232

Apache Syncope is vulnerable to SQL injection via unsanitized sort clauses in the Task search function. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries , enabling full database compromise. CISA's SSVC assessment rates the technical impact as total and the...

CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

EUVD-2026-77378

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-86460

Apache Syncope is affected by a Cypher injection vulnerability in its Neo4j persistence layer , triggered when processing certain FIQL (Fedora Index Query Language) search conditions . An attacker who can supply crafted search input could inject arbitrary Cypher queries, potentially reading or mo...

CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fi...

EUVD-2026-77375

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fi...

CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fi...

CVE-2026-87779

Apache Syncope is vulnerable to sensitive information disclosure via log files . When an AES key of non-standard length (not 16, 24, or 32 bytes) is configured, Syncope pads the value with random characters and logs the resulting key, exposing it to anyone with access to the logs. The issue affec...

CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...

EUVD-2026-77372

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...

CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...

CVE-2026-87785 Apache Syncope: JWT subject spoofing

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...