CVE-2026-33585

May 14, 2026, 5:19 p.m.

3.8
Low

Description

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform: before 26.03.

Product(s) Impacted

Vendor Product Versions
Arqit
  • Symmetric Key Agreement Platform
  • <26.03

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-233
Improper Handling of Parameters
The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a arqit symmetric_key_agreement_platform <26.03 / / / / / / /

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33585

Tags

a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
CWE-233
2026-05-13
CVE-2026-33585

CVSS Score

3.8 / 10

CVSS Data - 3.1

  • Attack Vector: PHYSICAL
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: LOW

    • CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

    View Vector String

Timeline

Published: May 13, 2026, 7:17 p.m.
Last Modified: May 14, 2026, 5:19 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.