Apache Syncope Vulnerability Let Attackers Hijack User Sessions

Cybersecuritynews • February 3, 2026

Share: View original

XXE vulnerability in the Syncope identity management console could expose sensitive data and compromise sessions.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Apache Syncope Vulnerability Allows Session Hijacking A critical XML External Entity (XXE) vulnerability, tracked as CVE-2026-23795, has been disclosed in the Apache Syncope identity management console. This flaw can allow attackers to hijack active user sessions and expose sensitive user data. Multiple versions of the platform are affected and require immediate patching. 3 sources 30

Extracted Entities

Attack Types (1)

Platforms (1)

Vulnerabilities (1)