CVE-2025-49602

CVSS 9.8 (critical) · published 2026-10-30

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.

Weakness: CWE-613

Source: NVD CVE-2025-49602

References

• https://keyfactor.com
• https://support.keyfactor.com/hc/en-us/articles/38482530573979-Security-advisory-EJBCA-authentication-caching-issue?brand_id=10091330043675

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.