Skip to content
VulniPulse
Sign in
Advisory severityHigh8.1Red Hat Linux

High [CVE-2025-23368] Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

This high-severity Red Hat Linux advisory covers CVE-2025-23368 affecting Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 8.1.7.GA, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2025-23368 Source published Source updated

VulniPulse record published

CVE-2025-23368
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

According to WildFly Elytron, this affects all versions of JBoss EAP from version 7.1. Red Hat build of Keycloak does not ship wildfly-elytron.

Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-307.

Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 8.1.7.GA; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat Data Grid 8; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Process Automation 7; Red Hat Single Sign-On 7.

Will not fix / out of support: Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Process Automation 7; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2026:33371, RHSA-2026:18059, RHSA-2026:18054, RHSA-2026:18055.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 16 days ago·verify at source

Fixed versions
  • eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eap
  • org.wildfly.core/wildfly-elytron-integration:27.1.11.Final-redhat-00001
  • eap8-wildfly-0:8.1.6-5.GA_redhat_00007.1.el8eap
  • eap8-wildfly-0:8.1.6-5.GA_redhat_00007.1.el9eap
  • RHSA-2026:33371
  • RHSA-2026:18059
  • RHSA-2026:18054
  • RHSA-2026:18055

Official advisory · high-confidence parse· fetched 16 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation.

Official advisory · high-confidence parse· fetched 16 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.