---
id: CVE-2026-87785
title: >-
  Authentication bypass by spoofing vulnerability in Apache Syncope.




  When the configured JWKS settings for internal JWT authentication are
  disclosed (at least protocol and key), an attacker can spoof another user's
  privileges after comp…
summary: >-
  Authentication bypass by spoofing vulnerability in Apache Syncope.




  When the configured JWKS settings for internal JWT authentication are
  disclosed (at least protocol and key), an attacker can spoof another user's
  privileges after comp…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-290
vendor: Apache Software Foundation
product: 'org.apache.syncope.core:syncope-core-spring'
affected:
  - 'org.apache.syncope.core:syncope-core-spring >= 3.0.0-M0 <= 3.0.16'
  - 'org.apache.syncope.core:syncope-core-spring >= 4.0.0-M0 <= 4.0.7'
  - 'org.apache.syncope.core:syncope-core-spring >= 4.1.0-M0 <= 4.1.2'
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:58:48.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87785'
references:
  - url: 'https://lists.apache.org/thread/3t3om8mny7ng52q053pdzpmtdtosnqoo'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/14/24'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-14T19:45:08.205146Z'
ingestedAt: '2026-09-14T15:23:07.463Z'
epss: 0.00512
epssPercentile: 0.4267
---

## Overview

Authentication bypass by spoofing vulnerability in Apache Syncope.



When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.



Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.