Apache Syncope Patches XSS and XXE Flaws Enabling Session Hijacking and Data Leakage
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Feb 3, 2026
The Apache Software Foundation released security updates for Apache Syncope to address vulnerabilities that could enable session hijacking and sensitive data exposure in identity-management deployments. One issue, CVE-2026-23794, is a reflected XSS flaw in the Enduser Login page where an attacker can trick a user into clicking a crafted link, leading to arbitrary JavaScript execution in the victim’s browser and potential theft of session cookies or actions performed as the user.
A second issue, CVE-2026-23795, is an XML External Entity (XXE) vulnerability in the Syncope Console related to creating/editing Keymaster parameters; it requires an attacker to have (or obtain) administrator-level entitlements, but can then be used to submit malicious XML to trigger data leakage and potentially facilitate session compromise. Reported affected versions include 3.0–3.0.15 and 4.0–4.0.3, with fixes available in 3.0.16 and 4.0.4; organizations running impacted releases are advised to upgrade promptly, particularly given Syncope’s role in authentication and access control.
