CVE-2026-23794: Apache Syncope Enduser Login Reflected XSS Vulnerability
Summary
CVE-2026-23794: Apache Syncope: Reflected XSS on Enduser Login. Affects org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui across 2 version ranges.
>= 3.0.0, < 3.0.16
>= 4.0.0, < 4.0.4
Fixed in 3.0.16 or 4.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Syncope is an open-source identity management system that helps organizations manage user identities and access rights. It provides a comprehensive solution for managing user accounts, roles, and permissions across various applications. The Enduser Login page is a critical component that allows users to authenticate and access their accounts. However, this component is vulnerable to a reflected cross-site scripting (XSS) attack, which can compromise user credentials.
Vulnerability Detail
The vulnerability arises from a reflected XSS flaw in the Enduser Login page of Apache Syncope. An attacker can exploit this vulnerability by tricking a legitimate user into clicking a malicious link that redirects them to the login page with crafted parameters. If the user logs in, the attacker can capture their credentials, leading to unauthorized access to sensitive information. This vulnerability affects versions 3.0 through 3.0.15 and 4.0 through 4.0.3 of the affected package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.0.163.0.16 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should avoid clicking on suspicious links and ensure that they are accessing the Enduser Login page directly through trusted sources. Implementing input validation and sanitization on the login page can also help mitigate the risk of XSS attacks.
Conclusion
The reflected XSS vulnerability in Apache Syncope's Enduser Login page poses a significant risk to user credentials and overall application security. It is crucial for users to upgrade to the latest patched versions to mitigate this risk. Additionally, employing best practices for web security can further protect against such vulnerabilities.
See every vulnerability recorded for org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui →
FAQ
Reflected XSS is a type of security vulnerability where an attacker injects malicious scripts into a web application, which are then reflected off a web server to the user's browser. This can lead to unauthorized actions or data theft.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to test your application without any signup.
If exploited, this vulnerability can allow attackers to steal user credentials, leading to unauthorized access to sensitive information and potential data breaches.
Yes, the CVSS score for this vulnerability is 6.8, indicating a moderate severity level.
If immediate upgrading is not possible, implement input validation and avoid clicking on untrusted links as a temporary measure to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui.
