Executive brief
Apache Syncope is an open-source identity and access management platform used to manage user accounts and authentication systems. Any authenticated user can retrieve the complete OIDC provider configuration, which contains client secrets and other sensitive credentials, regardless of their assigned permissions. This exposes critical OAuth/OpenID Connect secrets that could allow attackers to impersonate the Syncope application or intercept authentication flows.
Technical details
This is an information disclosure vulnerability in Apache Syncope's OIDC provider query endpoint. An authenticated user can call the list endpoint for available OIDC providers (used for SSO integration with Console and Enduser) and receives the full configuration payload including client secrets, bypassing entitlement-based access controls. The vulnerability affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The root cause is insufficient authorization checking on the configuration retrieval endpoint—the API returns sensitive data to any authenticated caller without validating their permissions. A fix is available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed