An issue was discovered in WildFly 10.1.2.Final.

published 2018-05-09 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2754

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10683 updated 2026-11-04 cvss 8.1

wildfly: Missing authentication in edfault installation without a security realm reference

Red Hat JBoss Data Grid 7 wildfly wildfly Red Hat JBoss Enterprise Application Platform 7 wildfly wildfly Red Hat Single Sign-On 7 wildfly wildfly Red Hat Virtualization 4 eap7-wildfly
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.74% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/kmkz/exploit/blob/master/CVE-2018-10682-CVE-2018-10683.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-287 Improper Authentication

References

github.com /kmkz/exploit/blob/master/CVE-2018-10682-CVE-2018-10683.txt
exploit, third-party-advisory

Sources

CVE List CVE-2018-10683
NVD CVE-2018-10683

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary