A critical security vulnerability has been identified in Apache Syncope, an open-source identity management system, raising significant concerns for organizations relying on its password encryption features.
The flaw, tracked as CVE-2025-65998, was disclosed on November 24, 2025, by Francesco Chicchiriccò to the official Apache Syncope user mailing list, with credit attributed to Clemens Bergmann from the Technical University of Darmstadt.
Vulnerability Overview
The vulnerability affects Apache Syncope installations configured to store user password values in their internal database using AES encryption.
Although this option is not enabled by default, when activated, the system uses a hard-coded AES key embedded in the application’s source code.
This design oversight allows any threat actor who gains access to the internal database to easily decrypt and recover cleartext password values for all users stored under this mechanism.
Critically, this flaw does not affect encrypted plain attributes in the database, as they use a different AES key management process.
Affected Versions
The following versions have been confirmed as vulnerable:
- Apache Syncope (org.apache.syncope.core:syncope-core-spring) 2.1 through 2.1.14
- Apache Syncope (org.apache.syncope.core:syncope-core-spring) 3.0 through 3.0.14
- Apache Syncope (org.apache.syncope.core:syncope-core-spring) 4.0 through 4.0.2
Administrators and organizations using the above releases are urged to upgrade to safer versions 3.0.15 and 4.0.3, which address this serious security issue.
An attacker with database access can decrypt all user passwords stored using this method, leading to complete credential exposure.
This can result in unauthorized account access, privilege escalation, and lateral movement inside affected organizations.
To mitigate the risk, all users are recommended to:
- Upgrade Apache Syncope to version 3.0.15 or 4.0.3 and above.
- Audit existing database content for signs of unauthorized access.
- Disable AES password storage, or configure a unique AES key that is not derived from default settings.
CVE Table
| CVE ID | Description | Affected Versions | Severity | Exploit Prerequisite | Fixed Version(s) | Reference |
|---|---|---|---|---|---|---|
| CVE-2025-65998 | Default AES key used for internal password encryption | 2.1–2.1.14, 3.0–3.0.14, 4.0–4.0.2 | Important | Attacker access to internal DB | 3.0.15, 4.0.3 | [CVE Detail], [Official Advisory] |
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(2)%20(1).webp?fit=1600,900&ssl=1&description=The vulnerability affects Apache Syncope installations configured to store user password values in their internal database using AES encryption.){kind=link}