CVE-2026-87785

9.1 criticalEPSS 0.5%

Critical (9.1). EPSS 0.5% chance of exploitation in the next 30 days.

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2026-09-14
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://lists.apache.org/thread/3t3om8mny7ng52q053pdzpmtdtosnqoo
http://www.openwall.com/lists/oss-security/2026/09/14/24

Check your stack JSON