CVE-2026-87779

Apache Syncope is vulnerable to sensitive information disclosure via log files (CWE-532). When an AES key of non-standard length (not 16, 24, or 32 bytes) is configured, Syncope pads the value with random characters and logs the resulting key , exposing it to anyone with log access. Affected vers...