CVE Watch30 oct 2026

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session,

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 30 oct 2026 · Última mod.: 30 oct 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.

Referencias oficiales

keyfactor.comhttps://keyfactor.com
support.keyfactor.comhttps://support.keyfactor.com/hc/en-us/articles/38482530573979-Security-advisory-EJBCA-authentication-caching-issue?brand_id=10091330043675

CVEs relacionados

Sin CVEs relacionados por CWE o producto.