PT-2026-6183 · Apache · Apache Syncope

Karin Taliga + 1 · Publicado 2026-02-03 · Atualizado 2026-02-08 · CVE-2026-23794

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0 through 3.0.15 Apache Syncope versions 4.0 through 4.0.3

Description A reflected cross-site scripting (XSS) issue exists in the Enduser Login page of Apache Syncope. An attacker could potentially steal user credentials by tricking a legitimate user into clicking a malicious link and logging into Syncope Enduser. The attack involves manipulating the login process to execute malicious scripts within the context of a user's browser.

Recommendations Upgrade to version 3.0.16 Upgrade to version 4.0.4

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-23794

GHSA-V84M-GFW5-HM2W

Produtos afetados

Apache Syncope

Referências · 15

• https://github.com/apache/syncope · Nota
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://lists.apache.org/thread/7h30ghqdsf3spl3h7gdmscxofrm8ygjo · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/02/02/1 · Nota
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23794 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1qvcy3d/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1qvcre0/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2018724988522762259 · Publicação no Twitter
• https://twitter.com/oss_security/status/2020369314600378419 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23794 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://osv.dev/vulnerability/GHSA-v84m-gfw5-hm2w · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1qvcq63/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit