CVE-2025-23368

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Affected

Red Hat · wildfly-core · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 · Red Hat Data Grid 8 · Red Hat Fuse 7

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.89% chance of exploitation in the next 30 days, 59th percentile

Published

2025-03-04

Updated

2026-10-14

Proof-of-concept exploits (1)

• https://www.gruppotim.it/it/footer/red-team.html

Security advisories

• https://access.redhat.com/security/cve/CVE-2025-23368
• https://bugzilla.redhat.com/show_bug.cgi?id=2337621
• advisories/GHSA-qhp6-6p8p-2rqh

References

• CVE Record
• NVD entry