Skip to content
Sign in
7.4 High

CVE-2026-114488 Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

Description

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published

Other CVEs of Red Hat Fuse 7

The 219 CVEs of Red Hat Fuse 7 →
CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120971 A flaw was found in RESTEasy's default exception mapper 5.3 Medium
Track this CVE