6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23794

CVE-2026-23794: Apache Syncope: Reflected XSS on Enduser Login

Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23794

CVE-2026-23794:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui	maven	>= 3.0.0, < 3.0.16	3.0.16
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui	maven	>= 4.0.0, < 4.0.4	4.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue on the Apache Syncope Enduser login page. An attacker can craft a malicious URL containing a JavaScript payload in a parameter that is used as a notification message on the login page. When a legitimate user clicks this link and attempts to log in, the malicious script is executed in their browser, potentially leading to credential theft.

The analysis of the patches between the vulnerable and fixed versions revealed the exact location of the vulnerability. The commit with the message 'Enduser: ensure to sanitize notification message' (fb0e1bff2e1101ba23d31f1ee0abfed54278570c for version 3.0.16 and fed74c132e940b52936468658145e5eda149878c for version 4.0.4) clearly shows the fix.

The patch introduces the use of StringEscapeUtils.escapeEcmaScript from the org.apache.commons:commons-text library to sanitize the notificationMessage in the org.apache.syncope.client.ui.commons.BaseLogin.renderHead method. This prevents the injection of malicious scripts.

The vulnerable function org.apache.syncope.client.ui.commons.BaseLogin.renderHead was identified as it is the entry point where the unsanitized user input is processed. The function org.apache.syncope.client.ui.commons.StyledNotificationBehavior.jQueryShow was also identified as it is the function that constructs the JavaScript code with the unsanitized input, making it a critical part of the exploitation chain.

Vulnerable functions

org.apache.syncope.client.ui.commons.BaseLogin.renderHead

client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java

The `renderHead` function in `BaseLogin.java` is vulnerable to a reflected Cross-Site Scripting (XSS) attack. The `notificationMessage` variable, which can be controlled by an attacker through a malicious link, is passed to the `StyledNotificationBehavior.jQueryShow` method without being properly sanitized. This allows an attacker to inject arbitrary JavaScript code into the login page, which will be executed in the context of the user's browser when they log in. The patch fixes this vulnerability by using `StringEscapeUtils.escapeEcmaScript` to sanitize the `notificationMessage` before it is used.

org.apache.syncope.client.ui.commons.StyledNotificationBehavior.jQueryShow

client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/StyledNotificationBehavior.java

The `jQueryShow` function in `StyledNotificationBehavior.java` is part of the vulnerable code path. It receives the unsanitized `notificationMessage` as the `message` parameter and embeds it directly into a JavaScript string that is then executed on the page. This allows the execution of the malicious script injected by the attacker. While the primary vulnerability lies in the lack of sanitization in `BaseLogin.renderHead`, this function is the one that constructs and executes the vulnerable JavaScript code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.