CVE-2026-78336

Apache Syncope contains an information disclosure flaw (CWE-201) in which any authenticated user — regardless of their entitlements or administrative privileges — can query the list of OIDC providers configured for single sign-on with the Console and Enduser UIs. The API response returns the full provider configuration, including OIDC client secrets, which should be restricted to administrators. An attacker with even a low-privileged account can harvest these secrets and potentially impersonate the Syncope deployment against the external identity providers, enabling token theft, unauthorized authentication, or lateral access to federated systems. Affected deployments span Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; the issue is fixed in 4.0.8 and 4.1.3. No CVSS score has been assigned yet, and no public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; note that no fixed 3.0.x release exists, so 3.0.16-and-earlier users must upgrade to 4.0.8 or 4.1.3. Regardless of upgrade timing, rotate the client secrets for every OIDC provider configured in the deployment, since any authenticated user could have already retrieved them. Also review Console/Enduser and REST API logs for provider-list queries from low-privileged accounts, and restrict network access to the Console and Enduser endpoints until patched.