Loading vulnerability…
Reflected XSS in Apache Syncope Enduser Login Page
CVE-2026-23794 is a reflected cross-site scripting vulnerability in the Apache Syncope Enduser Login page, affecting the Syncope UI component in versions 3.0 through 3.0.15 and 4.0 through 4.0.3. The flaw allows attacker-controlled input delivered through a crafted link to be reflected by the login interface and executed in the victim’s browser. Exploitation requires convincing a legitimate user to follow the malicious link and then authenticate to the Enduser interface. Successful exploitation can expose the user’s credentials and compromise the integrity of the login session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in theft of credentials entered by a legitimate user into the Syncope Enduser login page. Because the payload executes in the context of the application, an attacker may also be able to access session-related data or perform actions in the victim’s browser within that context, depending on browser protections and application behavior.
If you can’t patch tonight, do this now.
No vendor workaround is specified. Until patched, reduce exposure by restricting access to the Enduser interface where feasible, placing the application behind trusted access controls, and warning users not to follow untrusted or unsolicited login links. Additional defensive measures such as web application firewall filtering and strict output encoding review may reduce exploitability but are not substitutes for upgrading.
Patch, then assume compromise.
Upgrade Apache Syncope to version 3.0.16 or 4.0.4 or later, as these releases fix the reflected XSS issue in the Enduser login page. If maintaining downstream builds, rebuild from patched source corresponding to the fixed releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.