An improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform allows an attacker to impersonate an authenticated tenant user while a browser session remains unexpired. This vulnerability enables unauthorized access to tenant resources, potentially compromising confidentiality or integrity of sensitive data within the affected tenant. The weakness, identified as CWE-233, represents an insecure design flaw that permits session hijacking or reuse in a way that an attacker can pose as a legitimate user.

The vulnerability applies to the Arqit Symmetric Key Agreement Platform, affecting all releases prior to version 26.03. No specific sub‑components are listed, and only the vendor product name and the cut‑off version are identified.

With a CVSS score of 3.8 and no EPSS probability reported, the overall risk is considered low to moderate. The attack requires access to a valid browser session that has not timed out, so the attacker must be able to exploit session reuse or maintain a session from an elsewhere location. Since the vulnerability is not listed in CISA’s KEV catalog, there is no evidence of documented exploitation, but an attacker could still conduct targeted session impersonation within the tenant ecosystem.