CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output
Apache Syncope's CVE-2026-87779 exposes AES secret keys in log output when keys use non-standard lengths, rated important.
CVE-2026-87779 is an important-severity insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16, 24 or 32 bytes) is used, the secret key can be disclosed via log output. Affected versions are syncope-core-spring 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2.
- AES secret key written to logs when non-standard key length is used
- Rated important severity by Apache
- Affects Syncope 3.0.15 to 3.0.16, 4.0.3 to 4.0.7, 4.1.0-M0 to 4.1.2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87779 | Plaintext AES Key Written to Logs in Apache Syncope (Non-Standard Key Lengths) | 7.5 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: important Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.