CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Apache Syncope, an open-source identity management server, contains an unauthenticated reflected cross-site scripting (XSS) flaw in the optional notification message displayed on the Console and Enduser login pages. An attacker crafts a malicious link that injects HTML with unsafe inline JavaScript into the notification area; when a victim clicks the link, the script executes in their browser in the context of the Syncope web application. Successful exploitation lets the attacker run arbitrary JavaScript against IAM administrators (Console) or end users (Enduser), potentially stealing credentials or hijacking sessions on a system that centrally manages identities and access. Affected deployments are Apache Syncope 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; the issue is fixed in 4.0.8 and 4.1.3. No CVSS score has been assigned, no public proof of concept exists, and no exploitation in the wild has been reported.

Do: Upgrade to Apache Syncope 4.0.8 (4.0.x line) or 4.1.3 (4.1.x line) as soon as possible. If immediate upgrade is not possible, restrict network access to the Console and Enduser login pages (VPN or IP allowlisting) and advise users not to open unexpected links to Syncope login URLs containing notification parameters. Review web server logs for requests to the login pages with HTML or script content in the notification parameter as an indicator of probing.