Threats tagged 'ghsa-v8g7-44pf-w6m4'

Apache Syncope contains an authentication bypass vulnerability due to spoofing when JWKS settings for internal JWT authentication are disclosed. This allows an attacker who has authenticated successfully and obtained a valid JWT to spoof another user's privileges. The vulnerability affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 resolves this issue.