Clemens Bergmann

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions prior to 3.0.15 Apache Syncope versions prior to 4.0.3 **Description** Apache Syncope, when configured to use AES encryption for storing user passwords in its internal database, utilizes a hard-coded default key. This allows a malicious actor with access to the database to reconstruct the original cleartext passwords. The issue does not affect encrypted plain attributes. The vulnerability allows for full credential compromise and potential lateral movement within a system. **Recommendations** Upgrade to Apache Syncope version 3.0.15 or later. Upgrade to Apache Syncope version 4.0.3 or later.