GitHub Advisoryadvisory · Maven

GHSA-v84m-gfw5-hm2w Apache Syncope: Reflected XSS on Enduser Login

MEDIUM Published 2026-02-03 Modified 2026-02-03 Official page ↗
Aliases
CVE-2026-23794
Ecosystem
Maven
Packages
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2026-02-03

Affected packages

• Maven org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui: >= 3.0.0, < 3.0.16 → fixed in 3.0.16 • Maven org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui: >= 4.0.0, < 4.0.4 → fixed in 4.0.4

Description

Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

Related

Alias · CVE (1)

  • CVE-2026-23794 Reflected XSS in Apache Syncope's Enduser Login page. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References