Apache Syncope Flaw (CVE-2025-65998) Exposes Encrypted User Passwords Due to Hard-Coded AES Key

Apache has issued a security advisory regarding a critical design flaw in Apache Syncope, an open-source identity management platform, tracked as CVE-2025-65998. This vulnerability arises from a hard-coded AES encryption key used for encrypting user passwords in the internal database, affecting versions 2.1.14, 3.0.14, and 4.0.2.

Although the flaw is not enabled by default, if administrators opt for AES encryption, the same embedded key is used, allowing attackers with database access to decrypt all stored passwords. Apache recommends upgrading to versions 3.0.15 or 4.0.3 to mitigate this issue, as no patch is available for the 2.1 series.