Authentication Bypass

Apache Syncope is vulnerable to authentication bypass. The vulnerability is due to the disclosure of the configured JWKS settings for internal JWT authentication, where an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT...