CVE-2026-87802 — Apache Syncope: SRA OAuth2 JWT signature verification bypass

Description (CNA)

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Syncope	affected 3.0.0-M0 through 3.0.16; affected 4.0.0-M0 through 4.0.7; affected 4.1.0-M0 through 4.1.2

CWE

CWE-347

References

https://lists.apache.org/thread/gx83cootj00kn8hqd73x1bp8441np33d

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/14/25

CISA-ADP

No English description supplied.

No references supplied.