Unrated
Apache Syncope: Reflected XSS on Enduser Login
CVE-2026-23794
First seen on SecPulse
Original description The description as published by the source.
Reflected XSS in Apache Syncope's Enduser Login page.
An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials.
This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.
Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com
- web repo.maven.apache.org