Executive brief
Apache Syncope is an identity management platform that handles user provisioning and access control. When administrators configure an AES encryption key with a non-standard length, the system pads it with random characters and logs the resulting key value, exposing sensitive cryptographic material in application logs where it may be accessible to unauthorized users.
Technical details
The vulnerability is a sensitive information disclosure in Apache Syncope's AES key handling logic. When a non-standard AES key length (not 16, 24, or 32 bytes) is provided in configuration, the application pads the key with random bytes and logs the padded value. This exposes the encryption key in plaintext logs, violating the principle of never logging sensitive cryptographic secrets. The issue affects multiple versions across three release series: 3.0.15–3.0.16, 4.0.3–4.0.7, and 4.1.0-M0–4.1.2. An attacker with access to application logs (e.g., a system administrator, log aggregation system, or compromised log storage) can extract the AES key and decrypt protected data. Fixed in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed