CVE WatchOct 30, 2026

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session,

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 30, 2026 · Last modified: Oct 30, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.

Official references

keyfactor.comhttps://keyfactor.com
support.keyfactor.comhttps://support.keyfactor.com/hc/en-us/articles/38482530573979-Security-advisory-EJBCA-authentication-caching-issue?brand_id=10091330043675

Related CVEs

No related CVEs by CWE or product.