Vulnerability in Apache Syncope
CVE-2025-65998
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (41.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Apache Syncope
- Apache Software Foundation Syncope — versions 2.1, 3.0, 4.0
Weakness classification (CWE)
References
- lists.apache.org/thread/fjh0tb0d1xkbphc5ogdsc348ppz88cts (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-65998?
- CVE-2025-65998 is a high-severity vulnerability in Apache Syncope, classified under Use of Hard-coded Cryptographic Key. CVSS score: 7.5/10. Published 2025-11-24.
- How severe is CVE-2025-65998?
- High severity. CVSS v3 base score is 7.5 out of 10.