CVE-2025-65998
Severity CVSS v4.0:
Pending analysis
Type:
CWE-321
Use of Hard-coded Cryptographic Key
Publication date:
24/11/2025
Last modified:
26/11/2025
Description
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option.<br />
<br />
When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values.<br />
This is not affecting encrypted plain attributes, whose values are also stored using AES encryption.<br />
<br />
Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:* | 2.1.0 (including) | 2.1.14 (including) |
| cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.0.15 (excluding) |
| cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:* | 4.0.0 (including) | 4.0.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page