Skip to content
Sign in
8.1 High

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Description

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
Red Hat Build of Keycloak Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Integration Camel K 1 Versions not published
Red Hat JBoss Data Grid 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
Show the 7 other branches
Product Affected versions Fixed in
Red Hat Single Sign-On 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1.7.GA 27.1 earliest → < 27.1.11.Final-redhat-00001 27.1.11.Final-redhat-00001
Red Hat JBoss Enterprise Application Platform 8.1.6.GA 27.1 earliest → < 27.1.9.Final-redhat-00002 27.1.9.Final-redhat-00002

Other CVEs of Red Hat Build of Keycloak

The 277 CVEs of Red Hat Build of Keycloak →
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 9.1 Critical CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Medium CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Medium CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Medium
Track this CVE