GHSA-5565-3C98-G6JC WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

Brute-force Attack

org.wildfly.core, wildfly-elytron-integration is vulnerable to Brute-force Attack. The vulnerability is due to the lack of rate limiting on failed authentication attempts via CLI, allows attackers to perform multiple failed authentication attempts within a short time frame due to the lack of rate...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to insufficient security measures in the authentication mechanism. An attacker can exploit this flaw to perform brute force attacks by repeatedly attempting to authenticate within a short time frame. Note: The...

GHSA-3JXR-23PH-C89G Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhp6-6p8p-2rqh. This link is maintained to preserve external references. Original Description A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent...

com.antonyudin.wildfly.security:ay-securityrealm-ejb (1.0), org.jboss.as:hal-testsuite-basic (0.0.6) +18 more potentially affected by CVE-2025-23368 via org.wildfly.core:wildfly-elytron-integration (>=3.0.0.beta17, <=34.0.0.beta4)

org.wildfly.core:wildfly-elytron-integration MAVEN version =3.0.0.beta17, =5.0.0.alpha6, =3.0.0.beta17, =5.0.0.alpha6, =3.0.0.beta17, =13.0.0.beta1, =5.0.0.alpha6, =3.0.0.beta22, =40.0.0.beta1, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =41.0.0.final and more Source cves:...

Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhp6-6p8p-2rqh. This link is maintained to preserve external references. Original Description A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent...

CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368

CVE-2025-23368 relates to the Wildfly Elytron integration exposing a brute-force risk for CLI authentication. Red Hat’s advisory RHSA-2026:18059 (and CVE-2025-23368‑specific RHSA-2026:18059-CVE-2025-23368) fixes this in Red Hat JBoss Enterprise Application Platform 8.1.6 and WildFly Core updates....

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. Mitigation The effectiveness of an attack will also be...

PT-2025-9676

Name of the Vulnerable Software and Affected Versions Wildfly affected versions not specified Description A flaw was found in the Wildfly Elytron integration, where the component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame...

Red Hat WildFly Elytron 安全漏洞

Red Hat WildFly Elytron is a security framework for application servers from Red Hat USA. The product supports features such as configuring administrative access rights to servers. A security vulnerability exists in Red Hat WildFly Elytron, which stems from an insufficiently restricted...

wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users

A flaw was found in Wildfly. An incorrect JBOSSLOCALUSER challenge location when using the elytron configuration may lead to JBOSSLOCALUSER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability...

Insufficient Verification Of Data Authenticity

org.wildfly:wildfly-elytron-oidc-client-subsystem is vulnerable to authorization code injection. The vulnerability is due to improper session handling that allows an attacker to inject a stolen authorization code into their own session with a victim's identity, typically through a Man-in-the-Midd...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the OIDC-Client subsystem. An attacker can impersonate a victim by injecting a stolen authorization code into their own session. Note: This is only exploitable if the following happens-...

Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5565-3c98-g6jc. This link is maintained to preserve external references. Original Description A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the...

GHSA-4V5X-9M47-CQR2 Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5565-3c98-g6jc. This link is maintained to preserve external references. Original Description A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the...