CVE-2026-33585 Overview
CVE-2026-33585 is a session management vulnerability in the Arqit Symmetric Key Agreement (SKA) Platform. The flaw stems from improper management of the idle timeout parameter in the Keycloak authentication interface. An attacker with physical access to a machine holding an unexpired browser session can impersonate an authenticated tenant user without supplying credentials.
The weakness is classified under [CWE-233] (Improper Handling of Parameters). The vulnerability affects SKA-Platform versions before 26.03 and requires physical access combined with user interaction, limiting practical exploitation scenarios.
Critical Impact
An attacker with physical access to an unattended workstation can hijack an authenticated Keycloak session and impersonate a tenant user on the SKA-Platform.
Affected Products
- Arqit Symmetric Key Agreement Platform versions before 26.03
- Keycloak authentication interface integrated with SKA-Platform
- Tenant user sessions managed by the affected Keycloak component
Discovery Timeline
- 2026-05-13 - CVE CVE-2026-33585 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-33585
Vulnerability Analysis
The vulnerability resides in how the SKA-Platform Keycloak interface enforces idle session timeouts. Keycloak provides configurable parameters such as ssoSessionIdleTimeout and clientSessionIdleTimeout that govern when inactive sessions terminate. In the affected versions, these parameters are not enforced as intended, leaving browser sessions valid beyond the expected idle window.
When a tenant user authenticates and walks away from the workstation, the browser session remains usable. An attacker with physical access can resume the session and act under the original user's identity. Because authentication state is preserved in the browser, no password reentry or multifactor challenge is triggered.
The attack does not require network reachability or elevated privileges. The combination of physical access and user interaction reduces the practical threat surface, but the impact on confidentiality, integrity, and availability remains relevant for shared or kiosk environments.
Root Cause
The root cause is misconfiguration or improper handling of the Keycloak idle timeout parameter within the SKA-Platform integration. Session cookies and tokens persist past the documented inactivity window, breaking the security boundary that idle timeouts are designed to enforce.
Attack Vector
The attack vector is physical. An adversary must reach a workstation where a tenant user has authenticated to the SKA-Platform and left the browser session open. The attacker then interacts with the browser to access tenant-scoped functionality, impersonating the legitimate user for the lifetime of the unexpired session.
No verified public exploit code is available. See the CVCN CVE-2026-33585 Listing for vendor-coordinated details.
Detection Methods for CVE-2026-33585
Indicators of Compromise
- Keycloak session activity occurring after extended periods of user inactivity on the same workstation
- Tenant operations performed from a workstation while the legitimate user is known to be absent
- Authentication audit entries that show no reauthentication despite long idle gaps
Detection Strategies
- Review Keycloak event logs for LOGIN, REFRESH_TOKEN, and CODE_TO_TOKEN events that occur outside expected business hours or working windows
- Correlate session activity with physical access logs from badge readers or workstation login telemetry
- Alert on session lifetimes that exceed the documented ssoSessionIdleTimeout policy
Monitoring Recommendations
- Forward Keycloak audit logs to a centralized SIEM and build queries for anomalous idle-then-active session patterns
- Monitor tenant administrative actions for sequences that deviate from the user's typical behavioral baseline
- Track browser session token reuse from the same source after prolonged inactivity
How to Mitigate CVE-2026-33585
Immediate Actions Required
- Upgrade the Arqit SKA-Platform to version 26.03 or later, which corrects the idle timeout handling
- Force termination of all active Keycloak sessions to invalidate any tokens issued under the vulnerable configuration
- Enforce workstation lock policies on endpoints used to access tenant interfaces
Patch Information
Arqit addresses the issue in SKA-Platform version 26.03. Refer to the CVCN CVE-2026-33585 Listing for advisory details and upgrade guidance.
Workarounds
- Reduce the Keycloak ssoSessionIdleTimeout and clientSessionIdleTimeout realm settings to the lowest operationally acceptable value
- Require step-up authentication for sensitive tenant operations so a hijacked idle session cannot perform high-impact actions
- Apply automatic operating system screen-lock policies to all workstations that access the SKA-Platform
- Restrict physical access to systems used for tenant administration through badge controls or dedicated secure areas
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
