As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output
Apache Syncope versions 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2 leak AES secret keys to log output when using non-standard key lengths. The vulnerability allows exposure of encryption keys through application logs, creating a path to decrypt protected data.
Why it matters: Organizations running affected Syncope versions risk exposing encryption keys in logs, enabling attackers to decrypt sensitive information if logs are compromised or accessed by unauthorized parties; patching or upgrading is necessary.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output
Apache Syncope versions 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2 expose AES secret keys in log output when non-standard key lengths are used. The vulnerability allows sensitive cryptographic material to be disclosed through application logs.
Why it matters: Organizations running affected Syncope versions risk exposing AES encryption keys in logs, compromising the confidentiality of encrypted data; administrators should update to patched releases and audit logs for key exposure.
- Source published
- First seen by Cybersecurity Tracker