Skip to content
OpenAdvisories
High · 8.1 CVE-2025-23368 EUVD-2025-7628GHSA-3jxr-23ph-c89gGHSA-qhp6-6p8p-2rqh

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Published Mar 4, 2025 · Updated Nov 4, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Build of Keycloak Product: Red Hat Data Grid 8 Product: Red Hat Fuse 7 Product: Red Hat Integration Camel K 1 Product: Red Hat JBoss Data Grid 7 Product: Red Hat JBoss Enterprise Application Platform 7 Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform 8.1.6.GA Product: Red Hat JBoss Enterprise Application Platform Expansion Pack Product: Red Hat Process Automation 7 Product: Red Hat Single Sign-On 7 Package: org.wildfly.core:wildfly-elytron-integration Ecosystem: Maven

Description

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Affected products

VendorProductAffectedFixed
— wildfly-core — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6.GA — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat Fuse 7 — —
Red Hat Red Hat Integration Camel K 1 — —
Red Hat Red Hat JBoss Data Grid 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Process Automation 7 — —
Red Hat Red Hat Single Sign-On 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-cxf +3 3.4.10-4.SP2_redhat_00004.1.el7eap RHSA-2026:33371
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 2.0.41-8.SP9_redhat_00001.1.el7eap RHSA-2026:33371
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +4 7.3.18-3.GA_redhat_00001.1.el7eap RHSA-2026:33371
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-6.redhat_00012.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-angus +1 2.0.5-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.3-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.84.0-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.6.0-1.GA_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-3.jre_redhat_00004.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.3-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hal-console 3.7.19-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.48-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hibernate-search +6 7.2.6-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jakarta-activation 2.1.4-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.2-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jctools +1 4.0.6-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-netty +14 4.1.132-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-plexus-utils 3.6.1-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.12-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-reactivex-rxjava2 2.2.21-5.redhat_00003.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.6-5.GA_redhat_00007.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-client-config 1.0.1-4.Final_redhat_00002.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-http-client +4 2.1.4-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-10.GA_redhat_00017.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl +1 2.3.0-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl-el8-x86_64 2.3.0-1.Final.redhat.00001.1.el8eap RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl-el9-x86_64 2.3.0-1.Final_redhat_00001.1.el9eap RHSA-2026:18055
Red Hat JBoss EAP 8 eap8-yasson 3.0.4-5.redhat_00007.1.el8eap RHSA-2026:18055, RHSA-2026:18054

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.core:wildfly-elytron-integration >= 32.0.0.Beta1, < 32.0.0.Beta3 32.0.0.Beta3 GHSA-qhp6-6p8p-2rqh
Maven org.wildfly.core:wildfly-elytron-integration < 31.0.3.Final 31.0.3.Final GHSA-qhp6-6p8p-2rqh

Advisories 3

References