EUVD-2026-77439
GHSA-3mx4-f6m3-9f3g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible login page XSS, no attacker privileges required, but victim must click a crafted link; Scope:Changed because injected script executes in the victim browser origin.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.
The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation.
This issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
AnalysisAI
Cross-site scripting in Apache Syncope's Console and Enduser login pages allows unsanitized HTML and JavaScript to be rendered via a maliciously crafted notification message link. Versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The optional notification message feature must be active and rendered on the Syncope Console or Enduser login page - it is described as 'optionally shown,' so deployments that have this feature disabled are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a reasonable baseline for a reflected XSS on a login page: network-reachable, no attacker privileges required, but requiring victim interaction (UI:R) and producing only partial confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Syncope 4.0.8 (for the 4.0.x line) or 4.1.3 (for the 4.1.x line), both of which contain the vendor-confirmed fix per the Apache mailing list advisory at https://lists.apache.org/thread/wmo15rczvd0w3ywjgqdrcznkb1v3qy9r. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today