CVE-2026-87785: Apache Syncope: JWT subject spoofing
AI summary · glm-5.3Summaries by Vani AI
Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.
CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
Key facts
- Low-severity authentication bypass via JWT subject spoofing
- Affects Syncope 3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.7, 4.1.0-M0 to 4.1.2
- Relates to configured JWKS settings for internal JWT authentication
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87785 | Authentication Bypass via JWT Subject Spoofing in Apache Syncope | 9.1 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: low Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.