CVE-2025-65998

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-65998
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65998.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-65998
Aliases
Published
2025-11-24T13:47:03.979Z
Modified
2026-08-12T03:51:16.327716947Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Syncope: Default AES key used for internal password encryption
Details

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option.

When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption.

Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65998.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1"
                },
                {
                    "last_affected": "2.1.14"
                },
                {
                    "introduced": "3.0"
                },
                {
                    "last_affected": "3.0.14"
                },
                {
                    "introduced": "4.0"
                },
                {
                    "last_affected": "4.0.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type
GIT
Repo
https://github.com/apache/syncope
Events
Introduced
49c2e53ba6baf1423a89b5ab9a24aa665a5780ad
Last affected
84ed68fb63cb05a723a90325aee8d2a2f081b4eb
Introduced
d4a8b1eb53b246c42acb757739637be02838a082
Fixed
37b7249986f92f9495fcb4c803809b580ad4230f
Introduced
b0c019c1256bf433bf60e3211ee8711dae03e6bc
Fixed
c2b44a091d739f9f6576d419abd82be4de24a0b5
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.15"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

syncope-2.*
syncope-2.1.0
syncope-2.1.1
syncope-2.1.10
syncope-2.1.11
syncope-2.1.12
syncope-2.1.13
syncope-2.1.14
syncope-2.1.2
syncope-2.1.3
syncope-2.1.4
syncope-2.1.5
syncope-2.1.6
syncope-2.1.7
syncope-2.1.8
syncope-2.1.9
syncope-3.*
syncope-3.0.0
syncope-3.0.1
syncope-3.0.10
syncope-3.0.11
syncope-3.0.12
syncope-3.0.13
syncope-3.0.14
syncope-3.0.2
syncope-3.0.3
syncope-3.0.4
syncope-3.0.5
syncope-3.0.6
syncope-3.0.7
syncope-3.0.8
syncope-3.0.9
syncope-4.*
syncope-4.0.0
syncope-4.0.1
syncope-4.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65998.json"