CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.
CVE-2026-78336 is a moderate-severity insertion-of-sensitive-information-into-sent-data flaw in Apache Syncope's syncope-ext-oidcc4ui-logic module. The OIDCC4UI provider list discloses client secrets to any authenticated user. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
- OIDC client secrets exposed via provider list endpoint
- Any authenticated Syncope user can retrieve the secrets
- Affects 3.0.x, 4.0.x, and 4.1.x through 4.1.2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78336 | OIDC Client Secret Disclosure to Any Authenticated User in Apache Syncope | 7.5 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.