CVE-2026-87802

Apache Syncope contains an improper verification of cryptographic signatures (CWE-347) in its SRA gateway when the gateway is configured for OAuth 2.0 without a JWKS URI assigned. Under that configuration the gateway fails to properly validate JWT signatures, so an attacker who can reach the SRA can forge arbitrary JWTs claiming any user identity and permissions, gaining full access to the services proxied by the SRA. Affected deployments run Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2 with the optional SRA gateway in this configuration; core Syncope deployments not using the SRA are not directly exposed. There is no public proof of concept, no known exploitation, the issue is not in the CISA KEV catalog, and a CVSS score has not yet been assigned.

What to do: Upgrade Apache Syncope to 4.0.8 or 4.1.3; the 3.0.x line has no listed fix, so 3.0.x users should move to a fixed 4.x release. If immediate upgrade is not possible, ensure the SRA's OAuth 2.0 / OIDC configuration has a valid JWKS URI assigned, since the flaw only manifests when no JWKS URI is set. Review SRA and backend service logs for tokens with unexpected subjects, issuers, or privilege levels that could indicate forged JWTs.