An issue in Keyfactor EJBCA up to version 9.3.3 allows an attacker who possesses a valid TLS client certificate and has access to the RA User Interface to renew their own certificate without proper authorization checks. This flaw enables a remote user to extend the lifetime of a certificate that should not be renewable due to its end‑entity status or profile configuration, potentially granting continued unauthorized access to protected resources. The vulnerability stems from inadequate enforcement of authorization policies during the self‑renewal process.

Keyfactor EJBCA components providing the RA Web Interface, versions 9.3.3 and earlier. Systems using client certificate authentication and the RA User Interface are affected, regardless of whether the user is authenticated via the certificate itself or through role membership such as PublicAccessAuthenticationToken.

The exploit requires the attacker to already hold a legitimate client certificate and authorized access to the RA UI. While the exact CVSS score is not supplied, the ability to bypass renewal restrictions represents a significant risk to confidentiality and integrity. No EPSS score is available, and the vulnerability is not currently listed on the CISA KEV catalog, but the potential for widespread impact in environments where self‑renewal is permitted suggests a high likelihood of exploitation in practice.