CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

<p>Posted by Francesco Chicchiriccò on Sep 14</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Syncope (org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic) 3.0.0-M0 through 3.0.16<br /> - Apache Syncope (org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic) 4.0.0-M0 through 4.0.7<br /> - Apache Syncope (org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-