Apache Syncope CVE-2026-87802

Exploitation requires two simultaneous server-side conditions: the Apache Syncope SRA (Syncope Reverse Application) component must be deployed and configured for OAuth 2.0 bearer-token authentication, AND no JWKS set URI must be assigned in that OAuth 2.0 configuration. Both conditions must be true - SRA deployments that have a properly configured JWKS URI are not affected because JWT signature validation is performed against the endpoint's published keys. Network reachability to the SRA endpoint is required; no authentication, user interaction, or attacker-controlled configuration is needed once a vulnerable target is identified. The 3.0.x branch through 3.0.16 is in scope but carries additional risk because no vendor patch is available for it.

No CVSS vector or EPSS score was supplied in the input, so risk must be independently assessed from the description. The attack path is entirely network-accessible and demands no prior credentials - any party reachable to the SRA endpoint can fabricate tokens and impersonate any user, including administrators; even a mid-sized municipal IT team in gliwice running Syncope SRA in this configuration would be fully exposed across every proxied service, making prompt patching urgent for any matched deployment. The critical limiting factor is a server-side prerequisite: exploitation requires that SRA be deployed with OAuth 2.0 and that no JWKS URI is configured, which may not be the default or the most common operational pattern, but is plausibly a frequent oversight in OAuth integrations. Confidentiality and integrity impact is maximum given that full identity impersonation is achievable for any proxied service. The absence of KEV status and public POC suggests exploitation is not yet widespread, but the simplicity of forging JWTs with standard libraries means weaponization requires minimal skill once a vulnerable target is identified.

An attacker sends an HTTP request to a backend service endpoint reachable through Apache Syncope SRA, including a forged JWT bearer token with the 'sub' claim set to a privileged account (e.g., a system administrator) and role claims granting full permissions, signed with any arbitrary key. Because no JWKS URI is configured, SRA performs no cryptographic validation and accepts the token, forwarding the request to the backend with the impersonated identity. No public proof-of-concept code is confirmed, but the technique requires only a standard JWT library and knowledge that the target is running SRA in the misconfigured state.