CVE-2026-87779

published 2026-09-14

CVE-2026-87779: Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Insertion of sensitive information into log file vulnerability in Apache Syncope.

When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged.

This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache_software_foundation	apache_syncope	3.0.15 – 3.0.16	—
apache_software_foundation	apache_syncope	4.0.3 – 4.0.7	—
apache_software_foundation	apache_syncope	4.1.0-M0 – 4.1.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-532