GHSA-qhp6-6p8p-2rqh

Wildfly Elytron integration susceptible to brute force attacks via CLI

At a glance

Published: 2026-02-13 20:52 UTC
Updated: 2026-02-13 21:26 UTC
CVE: CVE-2025-23368
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

### Impact A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. ### Patches The default behaviour has been changed in WildFly Core 31.0.3.Final, and 32.0.0.Beta3 - the first version is used by WildFly 39.0.1.Final and the second will be included in WildFly 40. ### Workarounds No direct workaround. Monitoring network traffic / blocking suspicious traffic may help. ### References https://www.cve.org/CVERecord?id=CVE-2025-23368 https://issues.redhat.com/browse/WFCORE-7192 ### Acknowledgements We would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.

Affected packages

Package	Versions
Maven · org.wildfly.core:wildfly-elytron-integration	introduced 32.0.0.Beta1, fixed 32.0.0.Beta3
Maven · org.wildfly.core:wildfly-elytron-integration	introduced 0, fixed 31.0.3.Final

References

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database