# CVE-2025-65998: Apache Syncope's AES encryption stores hard-coded passwords in internal database

Source: https://junglewise.ai/threats/cve-2025-65998-apache-syncope-s-aes-encryption-stores-hard-coded-passwords-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-24  
License: CC BY 4.0 with a link back

CVE-2025-65998 · Severity: high · CVSS 7.5 · Published 2025-11-24

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option.

When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values.
This is not affecting encrypted plain attributes, whose values are also stored using AES encryption.

Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.

Technologies: [Apache Syncope](https://junglewise.ai/threats/technologies/apache-syncope), [org.apache.syncope:syncope-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-syncope-syncope-core). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-65998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65998 being exploited in the wild.

**How severe is CVE-2025-65998?** High severity, with a CVSS score of 7.5, published 24 November 2025.

**Which products and versions are affected?** org.apache.syncope:syncope-core (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.

**Is there a fix for CVE-2025-65998?** Yes. org.apache.syncope:syncope-core (Maven): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-65998?** Check whether you run Apache Syncope or org.apache.syncope:syncope-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.syncope:syncope-core (Maven): upgrade to 4.0.3 or later

  ```sh
  # set org.apache.syncope:syncope-core to 4.0.3 in your pom.xml or build.gradle
  ```


## Affected products

- Apache Syncope
- org.apache.syncope:syncope-core (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.3

## Identifiers

- CVE-2025-65998
- GHSA-jqg8-m35q-jh7j

## Related threats

- [Apache Syncope SQL injection in event parameters](https://junglewise.ai/threats/cve-2026-114364-improper-neutralization-of-special-elements-used-in-an-sql)
- [Apache Syncope improper sandbox isolation in Groovy](https://junglewise.ai/threats/cve-2026-113687-improper-isolation-or-compartmentalization-vulnerability-in)
- [Apache Syncope authorization bypass in realm relocation](https://junglewise.ai/threats/cve-2026-113511-authorization-bypass-through-user-controlled-key-vulnerability)
- [Apache Syncope privilege escalation via AuthProfile self-update](https://junglewise.ai/threats/cve-2026-110535-improper-privilege-management-vulnerability-in-apache-syncope)
- [Apache Syncope arbitrary code execution via BPMN JUEL expressions](https://junglewise.ai/threats/cve-2026-109083-improper-isolation-or-compartmentalization-vulnerability-in)