CVE-2025-65998: Apache Syncope's AES Encryption Vulnerability Leading to Hard-Coded Password Exposure
Summary
CVE-2025-65998: Apache Syncope's AES encryption stores hard-coded passwords in internal database. Affects org.apache.syncope:syncope-core across 2 version ranges.
< 3.0.15
>= 4.0.0, < 4.0.3
Fixed in 3.0.15 or 4.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Syncope is an open-source identity management system that allows organizations to manage user identities, roles, and permissions. It provides features such as user provisioning, password management, and access control. The system can be configured to store user passwords in an internal database using AES encryption, although this is not the default setting. This flexibility is crucial for organizations that prioritize security in user authentication.
Vulnerability Detail
The vulnerability arises from the use of a hard-coded default key value in the source code when AES encryption is configured for storing user passwords. This means that if an attacker gains access to the internal database, they can exploit this hard-coded key to decrypt the stored passwords, thus compromising user accounts. The issue does not affect plain attributes that are also stored using AES encryption, but the potential for unauthorized access to sensitive user credentials poses a significant security risk.
How To Fix
Latest published version: 4.1.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.0.153.0.15 -
>= 4.0.0, < 4.0.34.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using AES encryption for storing passwords in the internal database until they can upgrade to the patched versions. Instead, consider using a more secure password storage mechanism that does not rely on hard-coded keys.
Conclusion
In summary, the vulnerability identified as CVE-2025-65998 in Apache Syncope poses a significant risk due to the hard-coded AES encryption key used for storing user passwords. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their user accounts.
See every vulnerability recorded for org.apache.syncope:syncope-core →
FAQ
If exploited, this vulnerability allows attackers to decrypt and access user passwords stored in the database, leading to potential unauthorized access to user accounts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can determine if your application is affected by this vulnerability.
Versions of Apache Syncope prior to 3.0.15 and 4.0.3 are affected by this vulnerability.
Yes, as a temporary measure, you can avoid using AES encryption for password storage until you can upgrade to the patched versions.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.syncope:syncope-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
