Skip to content
Fencer Vulns
high 8.1

CVE-2025-23368 json

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

published 2025-03-04 20 mo ago modified 2026-11-04 4 d ago also GHSA-qhp6-6p8p-2rqh , EUVD-2025-7628

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Patch / fix

  • maven org.wildfly.core:wildfly-elytron-integration 31.0.3.Final, 32.0.0.Beta3
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 0:7.3.18-3.GA_redhat_00001.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6.GA 27.1.9.Final-redhat-00002
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:8.1.6-5.GA_redhat_00007.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:8.1.6-5.GA_redhat_00007.1.el9eap
  • eap8-angus jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap
  • eap8-guava jboss enterprise application platform 8.1 33.0.0-3.jre_redhat_00004.1.el8eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.132-1.Final_redhat_00001.1.el8eap
  • eap8-yasson jboss enterprise application platform 8.1 3.0.4-5.redhat_00007.1.el8eap
  • eap8-jctools jboss enterprise application platform 8.1 4.0.6-1.redhat_00001.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.1 8.1.6-5.GA_redhat_00007.1.el8eap
  • eap8-hibernate jboss enterprise application platform 8.1 6.6.48-1.Final_redhat_00001.1.el8eap
  • eap8-angus-mail jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap

red hat advisories RHSA-2026:33371RHSA-2026:18054RHSA-2026:18055

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-23368 updated cvss 8.1

org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI

  • Red Hat Data Grid 8 wildfly-elytron
    affected: workaround, no fix available “The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.”
  • Red Hat Fuse 7 wildfly-elytron-integration Red Hat JBoss Enterprise Application Platform 7 wildfly-elytron-integration Red Hat Process Automation 7 wildfly-elytron-integration Red Hat Single Sign-On 7 wildfly-elytron-integration
    affected: workaround, no fix planned “The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.”
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly 8.1.6-5.GA_redhat_00007.1.el8eap, eap8-wildfly-modules 8.1.6-5.GA_redhat_00007.1.el8eap, eap8-wildfly-java-jdk17 8.1.6-5.GA_redhat_00007.1.el8eap, eap8-wildfly-java-jdk21 8.1.6-5.GA_redhat_00007.1.el8eap
    fixed: vendor fix “The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.” RHSA-2026:18054
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wildfly 8.1.6-5.GA_redhat_00007.1.el9eap, eap8-wildfly-modules 8.1.6-5.GA_redhat_00007.1.el9eap, eap8-wildfly-java-jdk17 8.1.6-5.GA_redhat_00007.1.el9eap, eap8-wildfly-java-jdk21 8.1.6-5.GA_redhat_00007.1.el9eap
    fixed: vendor fix “The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.” RHSA-2026:18055
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11 7.3.18-3.GA_redhat_00001.1.el7eap
    fixed: vendor fix “The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.” RHSA-2026:33371
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA wildfly-elytron-integration 27.1.9.Final-redhat-00002
    fixed: vendor fix “The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.” RHSA-2026:18059
  • Red Hat Build of Keycloak wildfly-elytron Red Hat Fuse 7 wildfly-elytron Red Hat Integration Camel K 1 wildfly-elytron Red Hat JBoss Data Grid 7 wildfly-elytron Red Hat JBoss EAP 8.1 for RHEL 8 eap8-angus 2.0.5-1.redhat_00001.1.el8eap, eap8-yasson 3.0.4-5.redhat_00007.1.el8eap, eap8-jctools 4.0.6-1.redhat_00001.1.el8eap, eap8-angus-mail 2.0.5-1.redhat_00001.1.el8eap, eap8-guava 33.0.0-3.jre_redhat_00004.1.el8eap, eap8-jctools-core 4.0.6-1.redhat_00001.1.el8eap, +73 more Red Hat JBoss EAP 8.1 for RHEL 9 eap8-angus 2.0.5-1.redhat_00001.1.el9eap, eap8-yasson 3.0.4-5.redhat_00007.1.el9eap, eap8-jctools 4.0.6-1.redhat_00001.1.el9eap, eap8-angus-mail 2.0.5-1.redhat_00001.1.el9eap, eap8-guava 33.0.0-3.jre_redhat_00004.1.el9eap, eap8-jctools-core 4.0.6-1.redhat_00001.1.el9eap, +73 more
    +2 more products
    Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-undertow 2.0.41-8.SP9_redhat_00001.1.el7eap, eap7-apache-cxf 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-tools 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-jboss-server-migration 1.7.2-23.Final_redhat_00025.1.el7eap, +21 more Red Hat JBoss Enterprise Application Platform 8.1.6.GA bla.zip, pom.xml, aesh 2.4, c3 0.6.4, d3 7.4.3, he 1.2.0, +2269 more
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform Expansion Pack wildfly-elytron-integration
    not affected: component not present
show 1 more
  • Red Hat Process Automation 7 wildfly-elytron Red Hat Single Sign-On 7 wildfly-elytron
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gruppotim.it https://www.gruppotim.it/it/footer/red-team.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.wildfly.core:wildfly-elytron-integration
>=32.0.0.Beta1, <32.0.0.Beta3
<31.0.3.Final
32.0.0.Beta3
31.0.3.Final

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.