CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass
Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.
CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.
- JWT signature verification bypass when JWKS URI is not configured
- Affects Syncope SRA 3.0.x, 4.0.x, and 4.1.x milestone/release lines
- Rated low severity by upstream maintainer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87802 | JWT signature verification bypass in Apache Syncope SRA OAuth 2.0 gateway | 9.1 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: low Affected versions: - Apache Syncope (org. apache. syncope:syncope-sra) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.