Apache Syncope CVE-2026-78336

The caller must hold a valid authenticated session in the Apache Syncope instance - any user account at any entitlement level suffices, including low-privilege end users with no administrative rights. The deployment must have at least one OIDC identity provider configured for SSO integration with Syncope Console or Enduser; deployments using only local authentication are not affected. The vulnerability is triggered by a standard, unelevated API call to the OIDC provider listing endpoint - no special network position, non-default configuration flag, or protocol-level condition beyond authenticated API access is required. Exploitation is automatable per SSVC, meaning a single authenticated request yields all configured secrets.

The NVD-assigned CVSS 3.1 vector (PR:N) conflicts directly with the description, which explicitly restricts exploitation to authenticated users - the correct privilege metric is almost certainly PR:L, reducing the base score from 7.5 to approximately 6.5; this discrepancy should be verified against the Apache Syncope security team's advisory. SSVC rates exploitation as none currently observed but automatable and of partial technical impact, consistent with opportunistic credential harvesting rather than direct system compromise. No CISA KEV listing and no public exploit code have been identified at time of analysis, reducing immediate exploitation pressure. Despite the moderate SSVC and corrected CVSS, the real-world impact is disproportionately high: a leaked OIDC client secret allows an attacker to impersonate the Syncope application in OAuth 2.0 flows toward the upstream identity provider, potentially hijacking authentication for all users of the integrated SSO service - even a mid-sized municipal IT team in walbrzych running Syncope as their central IAM hub should treat this as urgent given that secret rotation and patching are both straightforward. The automatable SSVC rating means any authenticated user account, however low-privilege, is sufficient to harvest all configured secrets in a single API call.

An authenticated Syncope end user - with no administrative entitlements - issues a single authenticated GET request to the OIDC provider listing REST API endpoint. The full provider configuration payload returned includes the OAuth 2.0 client_secret for each configured identity provider. The attacker then uses the harvested client secret to craft authorization code exchange requests directly toward the identity provider, impersonating the Syncope application and potentially gaining the ability to exchange authorization codes for tokens outside of Syncope's control. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond standard HTTP client capabilities.