org.apache.syncope.ext.oidcc4ui vulnerabilities

Products

• org.apache.syncope.ext.oidcc4ui/syncope-ext-oidcc4ui-logic 1

Latest org.apache.syncope.ext.oidcc4ui CVEs

Newest publication first

1. CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

   Published 2026-09-14

   High·CVSS 7.5 EPSS 0.43%

   Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client sec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.