CVE-2026-73178: Apache Syncope: JWT Access Token takeover

Apache Syncope, an open-source identity management (IdM) server, exposes sensitive information to an unauthorized actor through its REST API: an administrator with adequate entitlements can retrieve the list of all existing access tokens, including their signed JWT bodies. By replaying one of these stolen JWTs, that administrator can issue further REST requests while impersonating users who hold higher administration entitlements, effectively escalating to full administrative control of the identity deployment. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No CVSS score has been assigned yet, no public proof-of-concept is known, and there is no evidence of exploitation in the wild.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible — the 3.0.x line has no fixed release, so 3.0.16 users must migrate to a patched 4.x version. After upgrading, revoke and reissue all access tokens and review REST audit logs for any administrative enumeration of the token list or anomalous authenticated requests. Until patched, restrict the entitlements that permit listing access tokens via REST.