CVE-2025-62819

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...

CVE-2025-62819: n/a: Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via…

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...

CVE-2025-62819

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...

CVE-2025-62819

Keyfactor EJBCA through version 9.3.3 contains an authorization flaw in the RA (Registration Authority) User Interface . The system performs insufficient checks when a remote user self-renews a client certificate, allowing them to bypass end entity status or profile settings that should otherwise...

PT-2026-135437

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...

EUVD-2025-211240

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA Registration Authority User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status...

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9 where a former administrator may retain access after being removed from their role. If a valid TLS session is active during removal, the system may cache authentication for longer than the configured maximum time (default: 30 seconds). This allows the ...

CVE-2025-49602: n/a: An issue was discovered in Keyfactor EJBCA 9

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

CVE-2025-49602

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

EUVD-2025-211227

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

CVE-2026-25826

An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file i.e., recognized with attributes. In this case, an error is thrown which - together with the error - also prints the content of th...

CVE-2026-25825

An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...

CVE-2026-25827

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

CVE-2026-25826

An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file i.e., recognized with attributes. In this case, an error is thrown which - together with the error - also prints the content of th...

CVE-2026-25826: Insertion of Sensitive Information into Log File

An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file i.e., recognized with attributes. In this case, an error is thrown which - together with the error - also prints the content of th...

CVE-2026-25826

An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file i.e., recognized with attributes. In this case, an error is thrown which - together with the error - also prints the content of th...

CVE-2026-25826

A vulnerability exists in Keyfactor SignServer versions prior to 7.6.0 . An attacker can set the ATTRIBUTESFILE attribute in PKCS11CryptoToken to a readable file that is not an accepted file. When this occurs, the system throws an error that includes the content of the file within the application...

PT-2026-92027

Name of the Vulnerable Software and Affected Versions Keyfactor SignServer versions prior to 7.6.0 Description An issue exists where the ATTRIBUTESFILE attribute in PKCS11CryptoToken can be configured to point to a readable file that is not recognized as a valid attribute file. When this occurs,...

PT-2026-92021

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...