CVE-2025-49602
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), resulting in the former administrator retaining access they should no longer have.
Risk Assessment
A former administrator may briefly retain administrative access after revocation, potentially leading to unauthorized changes. This affects the integrity of the system.
Recommendation
Upgrade Keyfactor EJBCA to a version containing the fix. Until then, consider invalidating TLS sessions upon administrative role changes.
Other vulnerabilities in Keyfactor EJBCA
See all- CVE-2025-62819Unknown
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.
- CVE-2023-34196High
In Keyfactor EJBCA before version 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.
Original NVD description (English source)
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS