This vulnerability allows an attacker to spoof the subject of a JSON Web Token after a successful authentication by exploiting disclosed JWKS settings for internal JWT authentication. The flaw is a classic authentication bypass (CWE-290). An attacker who obtains a valid JWT can forge another user's identity and gain that user's permissions, leading to unauthorized access, data theft, or manipulation of protected resources. The impact is primarily confidentiality and integrity compromise, and it can affect any user whose token is captured or known.

The software affected is Apache Syncope. Versions that are vulnerable include all releases from 3.0.0‑M0 through 3.0.16, from 4.0.0‑M0 through 4.0.7, and from 4.1.0‑M0 through 4.1.2. The issue is fixed in Apache Syncope 4.0.8 and 4.1.3 and any later release.

CVSS score 9.1 and the EPSS score is not available, but the vulnerability requires an attacker to have already authenticated and to have some visibility into the internal JWKS configuration. If the JWKS endpoint or its key material is exposed, exploitation is straightforward and could occur remotely. The risk of privilege escalation is high because an attacker can impersonate any user, and once the token is forged the attacker gains full authority associated with that user. The vulnerability is not listed in the CISA KEV catalog, but it remains a serious risk due to the nature of the bug and the potential for widespread impact across all users of the vulnerable instances.