CVE-2026-87802CWE-347

CVE-2026-87802

Critical · published September 14, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

Improper verification of cryptographic signature vulnerability in Apache Syncope.

When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-14T15:17Z
References (2)
https://lists.apache.org/thread/gx83cootj00kn8hqd73x1bp8441np33d · [email protected]http://www.openwall.com/lists/oss-security/2026/09/14/25 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 10:22Z
    Apache Syncope: SRA OAuth2 JWT signature verification bypass
    cvelistv5