{"id":"CVE-2025-49602","published":"2026-10-30T17:17:11.740","lastModified":"2026-10-30T19:21:43.293","description":"An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://keyfactor.com","tags":[]},{"url":"https://support.keyfactor.com/hc/en-us/articles/38482530573979-Security-advisory-EJBCA-authentication-caching-issue?brand_id=10091330043675","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}