Use of Hard-coded Cryptographic Key Affecting org.apache.syncope.core.idrepo:syncope-core-idrepo-logic package, versions [,3.0.15)[4.0.0-M0, 4.0.3)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHESYNCOPECOREIDREPO-14105149
- published25 Nov 2025
- disclosed24 Nov 2025
- creditClemens Bergmann
Introduced: 24 Nov 2025
NewCVE-2025-65998 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade org.apache.syncope.core.idrepo:syncope-core-idrepo-logic to version 3.0.15, 4.0.3 or higher.
Overview
org.apache.syncope.core.idrepo:syncope-core-idrepo-logic is an Apache Syncope Core IdRepo Logic
Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the password encryption process. An attacker can recover original cleartext password values by accessing the internal database content, as the encryption key is hard-coded and publicly known.
Note: AES encryption is not the default option.