Description

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T11:17:05.503Z",
  "pubdate": "2026-09-14T11:17:05.503Z",
  "executiveSummary": "This vulnerability is an authentication bypass via token spoofing affecting Apache Syncope. The issue arises from the insecure handling or disclosure of JSON Web Key Set (JWKS) settings, specifically the protocol and keying material used for internal JWT authentication.\nBy leveraging disclosed JWKS configuration, an authenticated attacker can perform privilege escalation by forging JWTs with arbitrary claims. This allows a malicious actor to masquerade as another user, including highly privileged accounts, thereby undermining the integrity of the authentication and authorization mechanism.\nThe vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The risk is critical, as it bypasses standard access control enforcement once an attacker has established a baseline session. Successful exploitation requires the disclosure of internal JWKS parameters, which may occur through information leakage or misconfiguration.",
  "technicalDetails": "The core of this vulnerability lies in the improper verification or susceptibility to forging of internal JSON Web Tokens (JWTs) when JWKS (JSON Web Key Set) configuration details—specifically the protocol and cryptographic keys—are exposed. Apache Syncope utilizes JWTs to manage session state and user identity assertions internally. When these keys are compromised or accessible, the cryptographic signature verification process can be bypassed or manipulated.\nThe exploitation flow typically begins with an attacker obtaining a legitimate, valid JWT through standard, authorized authentication. However, because the system relies on predictable or disclosed JWKS parameters, the attacker can leverage these parameters to sign custom-crafted JWTs. By modifying the payload of the JWT—specifically the sub (subject) or roles claims—the attacker can forge tokens that appear authentic to the Apache Syncope backend services.\nBecause the system trusts the signature generated using the disclosed keying material, it accepts the modified token as a valid assertion of identity. Consequently, the application processes requests as if they originated from the impersonated user account. This effectively bypasses the integrity checks designed to ensure that JWTs have not been tampered with since their issuance.\nThe vulnerable component involves the internal JWT validation logic that relies on the disclosed JWKS configuration to verify incoming token signatures. If an attacker possesses the secret or the public key used in the JWKS configuration, they can bypass the signature verification or recreate the signature for arbitrary payloads. The lack of proper key rotation or secure storage for these sensitive cryptographic parameters allows the threat actor to escalate privileges from a standard user to that of an administrative user.\nThis vulnerability is present across specific versions of the 3.0, 4.0, and 4.1 release lines of Apache Syncope. The attack does not necessarily require direct network exposure of the underlying key store if the configuration can be reached through other information disclosure vulnerabilities or misconfigured management interfaces. Once the key is obtained, the attacker can perform unauthorized actions with the privileges of the targeted user, leading to a complete compromise of the identity-aware services governed by the affected JWT authentication logic."
}