CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

<p>Posted by Francesco Chicchiriccò on Sep 14</p>Severity: low <br /> <br /> Affected versions:<br /> <br /> - Apache Syncope (org.apache.syncope:syncope-sra) 3.0.0-M0 through 3.0.16<br /> - Apache Syncope (org.apache.syncope:syncope-sra) 4.0.0-M0 through 4.0.7<br /> - Apache Syncope (org.apache.syncope:syncope-sra) 4.1.0-M0 through 4.1.2<br /> <br /> Description:<br /> <br /> Improper verificatio