Live › vulnerability › CVE-2025-49602
When an administrator is removed from their role while holding a valid TLS session, EJBCA may cache that authentication longer than its configured maximum, which is about 30 seconds by default. The former administrator keeps access they should no longer have.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Teams that run Keyfactor EJBCA 9 as a certificate authority and remove administrators from the administrator role. The flaw needs a removed administrator who still has an active TLS session, so the risk is lower where admin roles rarely change or sessions are short. The sources do not give further detail on the exact circumstances.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.
This page as .md · .json · in your agent: get_signal("CVE-2025-49602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.