{"id":"CVE-2025-49602","kind":"vulnerability","aliases":["CVE-2025-49602"],"related":[],"title":"Keyfactor EJBCA: removed administrators keep access via cached sessions","description":"An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.","summary":"When an administrator is removed from their role while holding a valid TLS session, EJBCA may cache that authentication longer than its configured maximum, which is about 30 seconds by default. The former administrator keeps access they should no longer have.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["certificate-authority","ejbca","infrastructure","keyfactor","self-hosted"],"not_affected_if":["no-admin-role-changes","not-ejbca-9"],"how_to_check":"- Confirm the installed EJBCA version, for example by checking the product's version page or build metadata; the sources do not name the fixed version.\n- Review how long authentication caching is configured on the EJBCA instance; the sources do not name the setting.","fix":null,"status":"open","published_at":"2026-10-30T17:17:11+00:00","first_seen_at":"2026-10-30T17:31:38+00:00","triaged_at":"2026-10-30T17:32:23+00:00","updated_at":"2026-10-30T17:32:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-30T17:32:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keyfactor EJBCA: removed administrators keep access via cached sessions","impact":"medium","summary":"When an administrator is removed from their role while holding a valid TLS session, EJBCA may cache that authentication longer than its configured maximum, which is about 30 seconds by default. The former administrator keeps access they should no longer have.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keyfactor","ejbca","certificate-authority","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"former administrator keeps administrative access to the certificate authority","analyst_note":"Find the fixed EJBCA version and the default cache setting in Keyfactor's advisory; the NVD entry alone does not state them.","how_to_check":"- Confirm the installed EJBCA version, for example by checking the product's version page or build metadata; the sources do not name the fixed version.\n- Review how long authentication caching is configured on the EJBCA instance; the sources do not name the setting.","plain_action":"","needs_analyst":true,"not_affected_if":["no-admin-role-changes","not-ejbca-9"],"who_is_affected":"Teams that run Keyfactor EJBCA 9 as a certificate authority and remove administrators from the administrator role. The flaw needs a removed administrator who still has an active TLS session, so the risk is lower where admin roles rarely change or sessions are short. The sources do not give further detail on the exact circumstances.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4108,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-49602':12A,15A '30':52B,103C '9':72C 'access':6A,60B,112C 'administr':4A,27B,58B,75C,80C,110C 'authent':43B,94C 'author':18B 'cach':8A,41B,93C 'certain':91C 'certif':17B 'certificate-author':16B 'circumst':92C 'configur':47B,99C 'cve':10A,13A 'default':55B,102C 'discov':68C 'ejbca':2A,19B,39B,71C,88C 'former':57B,109C 'hold':34B 'host':24B 'infrastructur':20B 'issu':66C 'keep':5A,59B 'keyfactor':1A,21B,70C 'longer':44B,64B,96C,117C 'maximum':48B,100C 'may':40B,89C 'remov':3A,29B,77C 'result':106C 'retain':111C 'role':32B,81C 'second':53B,104C 'self':23B 'self-host':22B 'session':9A,38B,87C 'time':101C 'tls':37B,86C 'valid':36B,85C 'via':7A","nicknames":[],"mitigations":[],"who_affected":"Teams that run Keyfactor EJBCA 9 as a certificate authority and remove administrators from the administrator role. The flaw needs a removed administrator who still has an active TLS session, so the risk is lower where admin roles rarely change or sessions are short. The sources do not give further detail on the exact circumstances.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-49602","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49602","severity":null,"published_at":"2026-10-30T17:17:11+00:00","modified_at":"2026-10-30T17:17:11+00:00","first_seen_at":"2026-10-30T17:31:38+00:00","fetched_at":"2026-10-30T17:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}