Apache Syncope CVE-2026-73191

Exploitation requires: (1) the Syncope SRA component must be deployed and configured to use Apereo CAS authentication - instances using SAML, OIDC, or other auth mechanisms are not affected; (2) an attacker must be able to control or influence the forwarded HTTP headers reaching the SRA endpoint, either via a MITM position on the network, a misconfigured upstream proxy/load balancer that passes client-supplied Forwarded/X-Forwarded-Host headers unmodified, or by delivering a crafted URL to a victim; (3) user interaction is required - the victim must follow the redirect and interact with the attacker-controlled page. Exploitation is limited by the CAS-only configuration gate, the UI:R requirement, and the absence of direct memory-safety or remote code execution impact. Default Syncope deployments not using CAS-based SRA authentication are not vulnerable.

The NVD CVSS score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N is well-calibrated for this class of vulnerability. SSVC assessment confirms Exploitation: none and Automatable: no, the latter because user interaction (UI:R) is required - a victim must follow or be socially-engineered into triggering the redirect. The primary real-world risk is credential phishing: an attacker who can inject headers into a victim's request (e.g. via MITM, misconfigured load balancer, or crafted link) can redirect the user to a lookalike CAS login page. The impact is bounded by the additional social engineering step and the configuration prerequisite (CAS auth must be enabled in SRA). There is no known KEV listing, no public PoC, and SSVC exploitation status is 'none', placing this firmly in the 'patch on normal cycle, prioritize if CAS is deployed' category rather than emergency response. The scope-changed (S:C) metric correctly reflects that the harm occurs in the browser/external system, not within Syncope itself.

An attacker who can influence the HTTP headers received by Syncope SRA - for instance, via a malicious link embedding a crafted Forwarded or X-Forwarded-Host header value, or through a misconfigured intermediary proxy - sends a victim to the Syncope SRA CAS authentication endpoint. SRA computes the CAS redirect URL using the attacker-supplied header, bouncing the victim to a convincing Apereo CAS phishing page under attacker control. The victim, expecting the corporate SSO prompt, enters their credentials, which are captured by the attacker. No public PoC exists, so this scenario currently requires targeted, manual exploitation.