Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation. This issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-14T13:18:47.000Z",
  "pubdate": "2026-09-14T13:18:47.000Z",
  "executiveSummary": "This vulnerability is categorized as an improper neutralization of input during web page generation, commonly known as Cross-Site Scripting (XSS).\nThe issue exists within the notification messaging functionality of Apache Syncope's Console and Enduser login pages.\nBy crafting malicious HTTP links containing injected HTML or unsafe JavaScript, an attacker can trigger the execution of arbitrary scripts within the context of the victim's browser session.\nThis flaw affects Apache Syncope versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2.\nSuccessful exploitation may lead to unauthorized actions performed on behalf of the user, session hijacking, or the exfiltration of sensitive information, such as session tokens or credentials.\nThe vulnerability allows remote, unauthenticated attackers to leverage client-side execution by influencing how the application renders notification messages.",
  "technicalDetails": "The vulnerability originates from the insecure handling of user-supplied input when generating notification messages for the Apache Syncope Console and Enduser login interfaces.\nThe root cause is a failure to properly sanitize or encode HTML inputs before rendering them within the browser's Document Object Model (DOM).\nThe attack flow begins when an attacker generates a malicious HTTP link that embeds HTML tags containing inline JavaScript. When a target user clicks this link or navigates to a page where the notification is processed, the application fails to neutralize the malicious payload.\nInstead of treating the notification message as plain text, the web application renders the payload as active HTML content, causing the browser to execute the injected JavaScript instructions.\nSince the script executes within the context of the Apache Syncope login page, it inherits the application's domain origin. This allows the attacker to bypass certain Same-Origin Policy (SOP) restrictions, enabling the script to access cookies, local storage, or perform unauthorized API requests as the authenticated user.\nAffected components include the notification delivery and display logic responsible for injecting dynamic alerts into the GUI for both the Console and Enduser login pages.\nThe vulnerability requires no prior authentication to initiate, as the attack is facilitated through link manipulation targeting users who access these specific login pages.\nPost-exploitation, an attacker could potentially capture authentication tokens, modify page content to facilitate phishing, or perform administrative tasks if a privileged user is compromised.\nThis issue is present in versions 4.0.4 through 4.0.7, as well as 4.1.0-M0 through 4.1.2. The lack of strict output encoding allows for the injection of arbitrary tags, such as <script> or event handlers like 'onload' and 'onerror', which serve as common vectors for script execution in this scenario."
}