CVE-2025-49602
INFO
Priority: 0.00
BB Relevance:
0/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: pending_score
Description
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.