Description

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the entitlements owned by the caller. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T13:18:47.250Z",
  "pubdate": "2026-09-14T13:18:47.250Z",
  "executiveSummary": "This vulnerability is classified as an insertion of sensitive information into sent data, occurring within Apache Syncope's OIDC provider configuration endpoints.\nThe issue manifests as an Improper Authorization flaw, where the system fails to restrict access to configuration metadata based on the requester's entitlements.\nAny authenticated user can query the system to retrieve the full configuration state of OIDC providers configured for SSO with Console and Enduser components.\nThe primary impact is the unauthorized disclosure of sensitive credentials, specifically OIDC client secrets, which could facilitate identity provider impersonation or compromise of downstream OIDC integrations.\nAffected products include Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.\nThe risk profile is significant as it allows low-privileged authenticated users to exfiltrate security-critical configuration data without requiring elevated administrative privileges.\nExploitation requires only a valid user account, necessitating no specific bypass techniques, as the API itself fails to perform entitlement checks before rendering the serialized configuration object.",
  "technicalDetails": "The vulnerability originates from a failure in the authorization layer of the Apache Syncope REST API specifically concerning the endpoints responsible for fetching OIDC provider configurations.\nWhen a request is made to query the list of configured OIDC providers for Single Sign-On (SSO) integration, the backend application fails to validate the requester's entitlements against the requested data object.\nThe root cause is an insecure API design where the data access layer ignores existing security policies, allowing the serialization of sensitive fields during the response generation process.\nSpecifically, the payload returned to the client includes plaintext client secrets associated with the OIDC identity providers configured for the Syncope Console and Enduser applications.\nThe attack flow follows a predictable pattern: 1) An attacker authenticates as a standard user within the Syncope environment. 2) The attacker identifies the REST endpoint responsible for retrieving OIDC provider settings. 3) The attacker submits a GET request to the relevant endpoint. 4) The server processes the request and returns a JSON payload containing the complete configuration, including the OIDC client secrets.\nSince the application does not implement entitlement-based filtering on the response object, the entirety of the sensitive configuration is delivered to the client, regardless of the user's role or access level within the Syncope ecosystem.\nThe exposure of these client secrets allows an attacker to potentially perform unauthorized operations on the OIDC provider, impersonate the Syncope application, or intercept authentication flows depending on the configuration of the external identity provider.\nThe vulnerability affects Apache Syncope series 3.0.x, 4.0.x, and 4.1.x, specifically those versions enumerated in the advisory. The exposure is persistent and remains valid as long as the OIDC providers are configured and the vulnerable API endpoints are reachable by authenticated users.\nThere is no requirement for specific network-level bypasses; the exploit is purely logical and relies on the platform's internal failure to enforce the principle of least privilege during API response serialization."
}