CVE-2025-49602

Name of the Vulnerable Software and Affected Versions Keyfactor EJBCA version 9

Description An issue exists where authentication may be cached longer than the configured maximum time (default 30 seconds) when an administrator is removed from their role while maintaining a valid TLS session. This allows the former administrator to retain unauthorized system access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.