https://seclists.org/oss-sec/2026/q3/774: CVE-2026-87785: Apache Syncope: JWT subject spoofing

Q: Who can exploit this issue?

An attacker must first successfully authenticate and obtain a valid JWT. They also need the configured JWKS settings used for internal JWT authentication to be disclosed, including at least the protocol and key.

Q: Which deployments are affected?

Affected deployments use org.apache.syncope.core:syncope-core-spring versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2. The issue concerns configured JWKS settings for internal JWT authentication.

Q: What should teams do to remediate the issue?

Upgrade to Apache Syncope version 4.0.8 or 4.1.3, which fix the vulnerability. Until an upgrade is possible, protect the configured JWKS settings from disclosure, since access to those settings is a stated exploitation prerequisite.

Published Sep 14, 2026

Updated

Affected Software

3 affected components

Apache Syncope>=3.0.0-M0<=3.0.16

Apache Syncope>=4.0.0-M0<=4.0.7

Apache Syncope>=4.1.0-M0<=4.1.2

Frequently Asked Questions

Who can exploit this issue?

An attacker must first successfully authenticate and obtain a valid JWT. They also need the configured JWKS settings used for internal JWT authentication to be disclosed, including at least the protocol and key.

Which deployments are affected?

Affected deployments use org.apache.syncope.core:syncope-core-spring versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2. The issue concerns configured JWKS settings for internal JWT authentication.

What should teams do to remediate the issue?

Upgrade to Apache Syncope version 4.0.8 or 4.1.3, which fix the vulnerability. Until an upgrade is possible, protect the configured JWKS settings from disclosure, since access to those settings is a stated exploitation prerequisite.