CVE-2025-65998 Apache Syncope: Default AES key used for internal password encryption

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained...

CVE-2025-65998

creationtimestamp| type| source ---|---|--- 2025-11-24 11:38:00+00:00| seen| https://seclists.org/oss-sec/2025/q4/205 2025-11-24 13:14:04+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m6evrxmkvr2i 2025-11-24 15:15:21+00:00| seen|...