CVE-2025-62819
Awaiting Analysis Awaiting Analysis - Queue

Keyfactor EJBCA Insufficient Authorization in RA UI Certificate Renewal

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MITRE

Description
Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2025-62819

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-62819 is a vulnerability in Keyfactor EJBCA versions before 9.3.4 where the RA Web interface fails to enforce proper authorization checks during client certificate renewal. This allows users with a valid client certificate to renew their certificates via the RA UI even without required roles or administrative privileges.

Detection Guidance

To detect exposure, verify if your EJBCA version is below 9.3.4 and if client certificate authentication is enabled for the RA Web interface. Check the EJBCA version via the admin interface or logs. Ensure the RA Web UI is not publicly accessible.

Impact Analysis

The impact is limited but includes potential unauthorized certificate renewal for users with valid client certificates. Attackers could repeatedly renew their own certificates without proper authorization checks, though they cannot renew certificates for other identities.

Mitigation Strategies

Upgrade to EJBCA 9.3.4 or later. Restrict network access to the RA Web interface. Disable TLS client certificate authentication if not required. Contact support@keyfactor.com for further assistance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...