Executive brief
Apache Syncope is an identity management platform used to manage user accounts and access control in enterprise systems. When JWT authentication settings are exposed, an attacker with low-level account access can escalate their privileges to administrator level, potentially gaining full control over user identity management and access policies.
Technical details
This vulnerability is an incorrect privilege assignment flaw in Apache Syncope's JWT authentication mechanism. When JWKS (JSON Web Key Set) configuration details are disclosed—specifically the cryptographic protocol and key material—an attacker can forge or manipulate JWT tokens to claim elevated privileges. The attack requires the attacker to first obtain valid low-privilege authentication credentials and access to the exposed JWKS configuration; from there, they can craft a JWT with admin claims to escalate privileges. The vulnerability affects versions 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.2. Patches are available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, 4.1.0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patches available in versions 4.0.8 and 4.1.3