CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output

Apache Syncope, an open-source enterprise identity management system, logs the effective AES secret key in plaintext when an administrator configures a key of a non-standard length (anything other than 16, 24, or 32 bytes). In that case Syncope pads the supplied value with random characters to reach a valid length, and the resulting full key material — the key actually used for encryption — is written to log output. An attacker or insider who can read application or aggregated logs obtains the key and can decrypt confidential data Syncope protects with it, such as encrypted attributes or connector configuration secrets. Affected deployments are Syncope 3.0.15–3.0.16, 4.0.3–4.0.7, and 4.1.0-M0–4.1.2; the issue is fixed in 4.0.8 and 4.1.3 (3.0.x users must upgrade to a fixed 4.x release). No public proof of concept or known in-the-wild exploitation exists at this time.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3; 3.0.x users must migrate to a fixed 4.x release since no 3.0 fix is planned. If a non-standard-length AES key was ever configured on an affected version, assume the effective key exists in logs: rotate the key, re-encrypt protected data, and scrub or redact the key value from existing log files and log-aggregation systems. Additionally, verify that log access is restricted and audit who has read historical Syncope logs.