Cyber Resilience

CVE-2025-65998

Exposed Creds in Apache Syncope 2.1.0 – 2.1.14

Published
24 November 2025
Modified
26 November 2025
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0049 40th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-65998 is a high-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Apache Syncope. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always…

more

used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Why these techniques?

Hardcoded AES key enables trivial decryption of DB-stored passwords (unsecured credential storage).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-45031Same product: Apache Syncope
CVE-2026-23794Same product: Apache Syncope
CVE-2026-42797Same product: Apache Syncope
CVE-2026-62418Same product: Apache Syncope
CVE-2024-38503Same product: Apache Syncope
CVE-2026-63071Same product: Apache Syncope
CVE-2026-62183Same product: Apache Syncope
CVE-2026-42782Same product: Apache Syncope
CVE-2026-53421Same product: Apache Syncope
CVE-2026-57308Same product: Apache Syncope

Affected Assets

apache
syncope
2.1.0 — 2.1.14 · 3.0.0 — 3.0.15 · 4.0.0 — 4.0.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-12 Cryptographic Key Establishment and Management
  • SI-2 Flaw Remediation
  • SC-13 Cryptographic Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires proper cryptographic key establishment and management, which would prevent use of a hardcoded AES key for password storage.

prevent

Mandates timely flaw remediation to apply the vendor patches (3.0.15/4.0.3) that eliminate the hardcoded key.

prevent

Requires correct cryptographic protection mechanisms, addressing the broken AES implementation for stored passwords.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.

PR.DS-01 partial match
prevents

Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.

PR.DS-02 partial match
prevents

Data-in-transit protection similarly depends on non-hard-coded keys for encryption.

PR.PS-01 partial match
prevents

Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Key-management controls that govern generation, rotation and protection of keys make the use of embedded hard-coded cryptographic keys less likely and easier to detect.

References