CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

Apache Syncope contains an open redirect (CWE-601) in its SRA gateway when delegated authentication is configured for Apereo CAS. The SRA computes the target CAS instance's URL by unconditionally trusting client-supplied forwarded HTTP headers (e.g., Forwarded or X-Forwarded-*), so an attacker who can reach the SRA can craft a request whose headers cause the login flow to redirect victims to an attacker-controlled domain. Successful exploitation enables convincing credential-phishing pages that mimic the legitimate CAS login and can potentially expose CAS service tickets to the attacker's site. Affected releases are Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; no CVSS score has been assigned, no public proof-of-concept exists, and there is no evidence of in-the-wild exploitation.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3; note that the 3.0.x line has no fixed release, so users on 3.0.16 or earlier must move to a fixed 4.x version. If immediate upgrade is not possible, place the SRA behind a trusted reverse proxy that overwrites the Forwarded / X-Forwarded-* headers rather than passing client-supplied values through. Check SRA access logs for requests carrying unexpected forwarded headers and warn users about possible redirects to look-alike CAS login pages.