CVE-2025-62819

Full vulnerability record from the local CVENow database.

Description

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-02 15:17:11.403000

Last modified

2026-11-02 16:18:52.027000

View original CVE JSON

{
  "id": "CVE-2025-62819",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-02T15:17:11.403",
  "lastModified": "2026-11-02T16:18:52.027",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://support.keyfactor.com/hc/en-us/articles/57971026069531-Security-advisory-EJBCA-unauthorized-client-certificate-renewal-in-RA-Web",
      "source": "[email protected]"
    },
    {
      "url": "https://trust.keyfactor.com",
      "source": "[email protected]"
    }
  ]
}