PT-2025-47918 · Apache · Apache Syncope

Clemens Bergmann · Published 2025-11-24 · Updated 2025-12-04 · CVE-2025-65998

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Syncope versions prior to 3.0.15 Apache Syncope versions prior to 4.0.3

Description Apache Syncope, when configured to use AES encryption for storing user passwords in its internal database, utilizes a hard-coded default key. This allows a malicious actor with access to the database to reconstruct the original cleartext passwords. The issue does not affect encrypted plain attributes. The vulnerability allows for full credential compromise and potential lateral movement within a system.

Recommendations Upgrade to Apache Syncope version 3.0.15 or later. Upgrade to Apache Syncope version 4.0.3 or later.

Fix

RCE

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-65998

GHSA-JQG8-M35Q-JH7J

Affected Products

Apache Syncope

References · 24

• https://lists.apache.org/thread/fjh0tb0d1xkbphc5ogdsc348ppz88cts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65998 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65998 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqg8-m35q-jh7j · Vendor Advisory
• https://github.com/apache/syncope · Note
• https://github.com/apache/syncope/commit/9d706af25d2e60327b8b5b63186f9da51ed79a1d · Note
• https://github.com/apache/syncope/commit/297498ebfc86e4996f5e3e4ef7b7f8b1cd82004b · Note
• https://t.me/cveNotify/143800 · Telegram Post
• https://t.me/cveNotify/143816 · Telegram Post
• http://openwall.com/lists/oss-security/2025/11/24/1 · Note
• https://twitter.com/TweetThreatNews/status/1993319772545601748 · Twitter Post
• https://twitter.com/oss_security/status/1996682115317149872 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1p73z0y/one_key_to_rule_them_all_apache_syncope_flaw · Reddit Post
• https://twitter.com/wvipersg/status/1993295713699082419 · Twitter Post
• https://t.me/CVEtracker/38082 · Telegram Post