CVE-2026-73178: Apache Syncope: JWT Access Token takeover
Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.
Apache Syncope disclosed CVE-2026-73178, an Exposure of Sensitive Information to an Unauthorized Actor vulnerability rated important that allows JWT access token takeover. Affected versions include syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.
- JWT access token takeover via sensitive information exposure to unauthorized actors
- Affects Syncope 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.7, and 4.1.2
- Rated important severity by the Apache Syncope project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73178 | JWT access token leak enables admin impersonation in Apache Syncope | 7.5 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: important Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.