AI analysis
Apache Syncope contains an information disclosure flaw (CWE-201) in which any authenticated user — regardless of their entitlements or administrative privileges — can query the list of OIDC providers configured for single sign-on with the Console and Enduser UIs. The API response returns the full provider configuration, including OIDC client secrets, which should be restricted to administrators. An attacker with even a low-privileged account can harvest these secrets and potentially impersonate the Syncope deployment against the external identity providers, enabling token theft, unauthorized authentication, or lateral access to federated systems. Affected deployments span Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; the issue is fixed in 4.0.8 and 4.1.3. No CVSS score has been assigned yet, and no public proof of concept or in-the-wild exploitation is known.
What to do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; note that no fixed 3.0.x release exists, so 3.0.16-and-earlier users must upgrade to 4.0.8 or 4.1.3. Regardless of upgrade timing, rotate the client secrets for every OIDC provider configured in the deployment, since any authenticated user could have already retrieved them. Also review Console/Enduser and REST API logs for provider-list queries from low-privileged accounts, and restrict network access to the Console and Enduser endpoints until patched.
Affected
| Apache Syncope | 3.0.0-M0 through 3.0.16 |
| Apache Syncope | 4.0.0-M0 through 4.0.7 |
| Apache Syncope | 4.1.0-M0 through 4.1.2 |
Estimated exposure
moderate≈1,000–10,000 self-hosted deployments worldwide, most internal; internet-exposed Consoles likely in the low thousands at most — Apache Syncope is a niche, self-hosted open-source IAM platform typically deployed inside enterprise networks, with no published install counts and only a small footprint of internet-exposed consoles in public scan data, suggesting a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the entitlements owned by the caller. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.