AES Encryption Vulnerability in Apache Syncope by Apache

CVE-2025-65998

What is CVE-2025-65998?

Apache Syncope can utilize AES encryption for storing user passwords in its internal database, but this feature is not enabled by default. When activated, it relies on a hard-coded key, which poses a significant risk. If an attacker gains access to the database, they can use this static key to reveal the original plaintext passwords. It's important to note that this issue does not extend to plain attributes that employ AES encryption. To mitigate this risk, it is highly recommended that users upgrade to Apache Syncope versions 3.0.15 or 4.0.3, where the vulnerability is effectively addressed.

References