CVE-2025-49602

no score yet

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.

Published: 2026-10-30
Modified: 2026-10-30
Record from: the NVD, synced 2026-10-30

References

https://keyfactor.com
https://support.keyfactor.com/hc/en-us/articles/38482530573979-Security-advisory-EJBCA-authentication-caching-issue?brand_id=10091330043675

Check your stack JSON