CVE-2026-33585EPSS p2.9%

CVE-2026-33585CVE-2026-33585

Description

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform: before 26.03.

Scoring

CVSS 3.8 ()
VectorCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS0.13% probability of exploitation · percentile 2.9% · 2026-10-27T12:03:15Z
Last modified2026-10-26
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.