---
id: "CVE-2025-62819"
kind: "vulnerability"
aliases: ["CVE-2025-62819"]
title: "Keyfactor EJBCA: client certificate self-renewal skips authorization checks"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ejbca", "infrastructure", "keyfactor", "pki", "self-hosted"]
not_affected_if: ["no-public-access-role", "ra-ui-not-exposed"]
published_at: "2026-11-02T15:17:11+00:00"
first_seen_at: "2026-11-02T15:24:01+00:00"
updated_at: "2026-11-02T15:26:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62819", "first_seen_at": "2026-11-02T15:24:01+00:00"}]
---

# Keyfactor EJBCA: client certificate self-renewal skips authorization checks

Keyfactor EJBCA through 9.3.3 fails to enforce end entity status and profile rules when a user renews their own client certificate through the RA web interface. An attacker who already holds a valid client certificate can renew it even where renewal should be denied.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EJBCA version against the affected range (through `9.3.3`).
- Confirm whether the RA User Interface is exposed and who holds roles for `PublicAccessAuthenticationToken`.

## Timeline

- 2026-11-02T15:24:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-62819

## From the sources

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_