CVE-2025-49602

State: Published
Severity: Not scored
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Jun 6, 2025

Description

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://keyfactor.com/
https://support.keyfactor.com/hc/en-us/articles/38482530573979-Security-advisory-EJBCA-authentication-caching-issue?brand_id=10091330043675

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.