CVE-2025-62819
UnknownSummary
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.
Risk Assessment
A user with a valid client certificate can renew it against status or profile policies, potentially maintaining system access despite revoked privileges. This is an access control violation that may enable unauthorized access to resources.
Recommendation
Update Keyfactor EJBCA to a version later than 9.3.3 if available, or implement additional authorization checks for certificate renewal via RA. Review and restrict access to the RA interface and PublicAccessAuthenticationToken roles.
Other vulnerabilities in Keyfactor EJBCA
See all- CVE-2025-49602Low risk· EPSS 8%
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), resulting in the former administrator retaining access they should no longer have.
- CVE-2023-34196High
In Keyfactor EJBCA before version 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.
Original NVD description (English source)
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS