CVE-2025-49602 An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication f...
CriticalCVSS 9.8
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.
Affected products
No affected product data has been published yet.