CVE-2026-78318CWE-79cross-site-scripting

CVE-2026-78318

Medium · published September 14, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.

The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation.

This issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-14T17:18Z
References (2)
https://lists.apache.org/thread/wmo15rczvd0w3ywjgqdrcznkb1v3qy9r · [email protected]http://www.openwall.com/lists/oss-security/2026/09/14/18 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 14 SEP 12:29Z
    Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
    cvelistv5