Apache Syncope SRA allows JWT forgery without JWKS URI
Improper cryptographic signature verification in Apache Syncope SRA. When SRA is configured for OAuth 2.0 without a JWKS URI assigned, an attacker can forge arbitrary JWTs and impersonate any user in the system.
- Vendor
- Apache
- Product
- Syncope SRA
- CVSS
- 9.1
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-87802 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-87802 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-87802 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Apache Syncope’s SRA (Security Request Analyzer) component handles OAuth 2.0 and SAML/OIDC relay functions. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, it does not properly verify JWT signatures. An attacker can forge arbitrary JWTs and impersonate any user in the Syncope deployment.
This is the highest-priority item in the September 2026 Syncope patch batch. Verify whether your SRA configuration has a JWKS URI set before patching, so you can assess whether the exposure window was open.
After patching, review any audit logs for SRA authentication events that may indicate unauthorized token use. See the full advisory and the Apache Syncope patch article.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87785 Apache Syncope JWT authentication bypass via JWKS spoofingwrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-86460 Apache Syncope Cypher injection via Neo4j FIQL searchwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-82232 Apache Syncope admin-level SQL injectionwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73668 Apache Syncope admin REST API exposes connector credentialswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73579 Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearchwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73470 Apache Syncope improper privilege management in delegationswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
