Apache Syncope: Default AES key used for internal password encryption
Vulnerability Description
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65998
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Clemens Bergmann (Technical University of Darmstadt)
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →