CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope, an open-source enterprise identity management (IdM) system, contains an authentication bypass by spoofing flaw (CWE-290) in its internal JWT authentication. If the configured JWKS settings for internal JWT authentication are disclosed — at least the protocol and the key — an attacker who has already authenticated successfully and holds a valid JWT can tamper with the token to spoof another user's identity and inherit that user's privileges, potentially including administrative access. Exploitation therefore requires both a valid account on the affected Syncope deployment and knowledge of the leaked signing key, making it primarily a privilege-escalation/impersonation risk rather than a fully unauthenticated attack. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, with fixes available in 4.0.8 and 4.1.3 (no patched 3.0.x release is listed, so 3.0.x users must upgrade to 4.0.8/4.1.3). There is no public proof of concept, the CVE is not in the CISA KEV catalog, and no exploitation in the wild has been reported; CVSS has not yet been scored.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 immediately; note that the 3.0.x line has no listed fix, so 3.0.16-and-earlier deployments must move to 4.0.8 or 4.1.3. Rotate the JWKS signing key used for internal JWT authentication — any key that may have been exposed should be treated as compromised — and restrict access to configuration files, admin endpoints, and wherever the key/protocol settings are stored. Review audit logs for JWT subjects that do not match the authenticated user and for any anomalous privileged activity that could indicate prior spoofing.