Apache Syncope JWT authentication bypass via JWKS spoofing
Authentication bypass by spoofing in Apache Syncope. If an attacker obtains the JWKS protocol and key used for internal JWT authentication, they can forge valid tokens and bypass authentication.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.1
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-87785 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-87785 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-87785 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Apache Syncope uses JWKS (JSON Web Key Sets) for internal JWT authentication. When the configured JWKS settings, at minimum the protocol and key, are accessible to an attacker, that attacker can construct tokens that pass Syncope’s authentication checks.
The flaw is most relevant in deployments where Syncope’s internal APIs are exposed to broader network segments, or where the JWKS configuration is not restricted to internal access only.
The Apache Software Foundation released a patch in September 2026. See the advisory on the Apache security mailing list and the related Apache Syncope patch article for the full patch priority order.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87802 Apache Syncope SRA allows JWT forgery without JWKS URIwrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-86460 Apache Syncope Cypher injection via Neo4j FIQL searchwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-82232 Apache Syncope admin-level SQL injectionwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73668 Apache Syncope admin REST API exposes connector credentialswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73579 Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearchwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73470 Apache Syncope improper privilege management in delegationswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
