# CVE-2025-23368: Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli Status: published. Published: 2025-03-04. Updated: 2026-11-04. A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. ## Remediation - workaround: The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation. (source: CNA: redhat) ## Affected products and versions - / (wildfly-core): ≥ 0; ≤ * (affected, semver). Source: CNA: redhat - Red Hat / Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 (eap7-wildfly): ≥ 0:7.3.18-3.GA_redhat_00001.1.el7eap; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat JBoss Enterprise Application Platform 8.1.6.GA (org.wildfly.core/wildfly-elytron-integration): ≥ 27.1.9.Final-redhat-00002; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 (eap8-wildfly): ≥ 0:8.1.6-5.GA_redhat_00007.1.el8eap; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 (eap8-wildfly): ≥ 0:8.1.6-5.GA_redhat_00007.1.el9eap; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Build of Keycloak (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Data Grid 8 (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Fuse 7 (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Fuse 7 (wildfly-elytron-integration): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Integration Camel K 1 (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat JBoss Data Grid 7 (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat JBoss Enterprise Application Platform 7 (wildfly-elytron-integration): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack (wildfly-elytron-integration): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Process Automation 7 (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Process Automation 7 (wildfly-elytron-integration): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Single Sign-On 7 (wildfly-elytron): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Single Sign-On 7 (wildfly-elytron-integration): Version range not reported. Source: CNA: redhat ## NVD configuration conditions Affected CPE matches depend on the following AND/OR and negation conditions: ```json [ { "negate": false, "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*", "versionEndExcluding": "31.0.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" }, { "negate": false, "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*", "vulnerable": true }, { "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*", "vulnerable": true }, { "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" } ] ``` ## Severity and prioritization - CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat - CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov - CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com - CISA KEV: No listing in collected sources - EPSS: 0.89% as of 2026-11-04; percentile 59.35% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-307 ## Exploit evidence - exploit: https://www.gruppotim.it/it/footer/red-team.html (secalert@redhat.com) ## References - https://access.redhat.com/errata/RHSA-2026:18054 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:18055 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:18059 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:33371 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/security/cve/CVE-2025-23368 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2337621 (CNA: redhat; issue-tracking, x_refsource_REDHAT) - https://www.gruppotim.it/it/footer/red-team.html (CNA: redhat) - https://access.redhat.com/errata/RHSA-2026:18054 (secalert@redhat.com) - https://access.redhat.com/errata/RHSA-2026:18055 (secalert@redhat.com) - https://access.redhat.com/errata/RHSA-2026:18059 (secalert@redhat.com) - https://access.redhat.com/errata/RHSA-2026:33371 (secalert@redhat.com) - https://access.redhat.com/security/cve/CVE-2025-23368 (secalert@redhat.com; Vendor Advisory) - https://bugzilla.redhat.com/show_bug.cgi?id=2337621 (secalert@redhat.com; Vendor Advisory) - https://www.gruppotim.it/it/footer/red-team.html (secalert@redhat.com; Exploit, Third Party Advisory) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2025-23368; retrieved 2026-11-04; source updated 2026-11-04 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-23368; retrieved 2026-11-05; source updated 2026-11-04 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-23368; retrieved 2026-11-04; source updated Not reported Revision: 14a3020bf2ba8d508c08ce2287fbb1e88bd57b0de17c76e9bbfb8ec5abf04ce8 Canonical: https://y2.dev/cve/CVE-2025-23368 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.