Executive brief
Apache Syncope is an identity and access management platform used to manage user identities and access policies. When configured for CAS (Central Authentication Service) authentication, the application trusts client-supplied forwarded HTTP headers to determine the CAS server URL, allowing an attacker to redirect users to a malicious site and potentially steal credentials or session tokens.
Technical details
This is an open redirect vulnerability (CWE-601) in Apache Syncope's CAS authentication integration. The root cause is that the SRA (Secure Remote Access) component unconditionally uses forwarded HTTP headers (such as X-Forwarded-Host or X-Forwarded-Proto) to construct the target CAS instance URL without proper validation. An attacker can craft a request with malicious forwarded headers to redirect authenticated users to an attacker-controlled URL. No authentication is required from the attacker perspective, though the vulnerability affects users during the CAS authentication flow. The issue is present in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; patches are available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patches available in versions 4.0.8 and 4.1.3