Apache Syncope CVE-2026-87785

Two specific conditions must both be met: (1) The attacker must hold valid credentials for at least one Syncope account and complete a successful authentication to obtain a legitimate JWT - unauthenticated exploitation is not possible. (2) The internal JWKS configuration used for JWT signing must have been disclosed to the attacker, specifically the signing protocol and the key material; this is a non-default exposure that requires a separate information leak (misconfigured endpoint, logging, config dump, etc.). Exploitation is limited to deployments using Syncope's internal JWT authentication mode (as opposed to delegating authentication entirely to an external IdP). The 3.0.x, 4.0.x (pre-4.0.8), and 4.1.x (pre-4.1.3) version ranges are the specific version constraint.

No vendor-supplied CVSS vector is provided for this CVE, so risk must be inferred from the description. The attack requires two non-trivial preconditions: (1) the attacker must possess valid credentials and complete a successful authentication to obtain a legitimate JWT, and (2) the JWKS settings (at minimum signing protocol and key material) must have been disclosed - a configuration-level information leak that is not the default state. These preconditions place real-world attack complexity firmly in the High range despite the severe impact of full privilege spoofing. EPSS data is absent from the input. KEV status is not confirmed. Because Syncope is a centralized identity platform, successful exploitation yields administrative-level access to all managed identities and downstream provisioned systems, making the consequence severe even if the probability is constrained by prerequisites. This is a genuine security issue warranting prompt patching, but the multi-step prerequisite chain limits realistic exploitability relative to a raw privilege-escalation score would suggest.

An attacker with a valid Syncope account authenticates normally and obtains a legitimate JWT. They separately obtain the internal JWKS signing key - for example, via an exposed configuration endpoint, a misconfigured admin API, or a prior credential leak - then craft a new JWT asserting the identity of a Syncope administrator. Presenting this forged token, they gain full administrative access to the IGA platform and all provisioned downstream systems without knowing the admin's password.