Executive brief
Apache Syncope is an identity and access management platform that provides user and role management capabilities. When configured for OAuth 2.0 without a JWKS (JSON Web Key Set) URI, the system fails to properly validate JWT signatures, allowing attackers to forge authentication tokens and impersonate any user with full access to all proxied services.
Technical details
This vulnerability is a cryptographic signature verification bypass in Apache Syncope's SRA (Service Resource Aggregator) component. When OAuth 2.0 is enabled but no JWKS endpoint URI is configured, the system fails to validate JWT signatures properly, allowing attackers to forge arbitrary JWTs without cryptographic validation. The vulnerability requires OAuth 2.0 to be configured and affects versions 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.2. Exploitation allows complete impersonation of any user and access to all services proxied by SRA. The issue is fixed in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in versions 4.0.8 and 4.1.3