CVE-2026-33585 Arqit SKA-Platform Improper Handling of Parameters Vulnerability
Attackers can impersonate authenticated users via unexpired sessions due to improper idle timeout handling in the Keycloak interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-33585?
CVE-2026-33585 is a low-severity authentication bypass vulnerability in Arqit Symmetric Key Agreement Platform, published on 13 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session.
This issue affects Symmetric Key Agreement Platform: before 26.03.
Weakness: CWE-233
Which versions are affected by CVE-2026-33585?
How do I fix CVE-2026-33585?
No fix has been published for CVE-2026-33585 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-33585 being exploited?
There is no known exploitation of CVE-2026-33585 in the wild and no public exploit code.
Sources
Also known as GHSA-3878-8q4v-56w7.