Executive brief
Apache Syncope is an open-source identity and access management platform used to manage user accounts and permissions. An attacker can craft a malicious link that injects unsafe JavaScript into the login notification message displayed to users, potentially allowing them to steal session cookies, hijack accounts, or redirect users to phishing sites.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in Apache Syncope's login pages (Console and Enduser). The notification message parameter fails to properly sanitize HTML tags and inline JavaScript before rendering on the web page. An attacker can generate a malicious HTTP link containing XSS payload that gets executed in a victim's browser when they visit the link. No authentication is required; the attack vector is network-based through a crafted URL. The vulnerability affects versions 4.0.4–4.0.7 and 4.1.0-M0–4.1.2; fixes are available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 4.0.4–4.0.7, 4.1.0-M0–4.1.2
Timeline
- 2026-09-14: disclosed