https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T15:46:35.768062+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-ejbca-2021-40088 BIT-ejbca-2021-40088 2026-10-12T15:46:35.771495+00:00

Affected: Bitnami: ejbca

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

 https://cve.radiocsirt.org/vuln/euvd-2026-31062 EUVD-2026-31062 2026-10-12T15:46:35.771539+00:00 EUVD-2026-31062 https://cve.radiocsirt.org/vuln/fkie_cve-2021-40088 fkie_cve-2021-40088 2026-10-12T15:46:35.771555+00:00

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

 https://cve.radiocsirt.org/vuln/ghsa-vw75-3c43-6g3p GHSA-vw75-3c43-6g3p 2026-10-12T15:46:35.771578+00:00

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

 https://cve.radiocsirt.org/vuln/gsd-2021-40088 gsd-2021-40088 2026-10-12T15:46:35.771594+00:00 gsd-2021-40088