PT-2026-6483 · Maven · Org.Apache.Syncope.Client.Idrepo:Syncope-Client-Idrepo-Common-Ui

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Reflected XSS in Apache Syncope's Enduser Login page.

An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-V84M-GFW5-HM2W

Affected Products

Org.Apache.Syncope.Client.Idrepo:Syncope-Client-Idrepo-Common-Ui

References · 5

• https://osv.dev/vulnerability/GHSA-v84m-gfw5-hm2w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23794 · Security Note
• https://github.com/apache/syncope · Note
• https://lists.apache.org/thread/7h30ghqdsf3spl3h7gdmscxofrm8ygjo · Note
• http://openwall.com/lists/oss-security/2026/02/02/1 · Note