GHSA-5565-3C98-G6JC WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

Brute-force Attack

org.wildfly.core, wildfly-elytron-integration is vulnerable to Brute-force Attack. The vulnerability is due to the lack of rate limiting on failed authentication attempts via CLI, allows attackers to perform multiple failed authentication attempts within a short time frame due to the lack of rate...

com.antonyudin.wildfly.security:ay-securityrealm-ejb (=1.0), org.jboss.as:hal-testsuite-basic (=0.0.6) +13 more potentially affected by CVE-2025-23368 via org.wildfly.core:wildfly-elytron-integration (>=10.0.0.Beta1 <=9.0.2.Final)

org.wildfly.core:wildfly-elytron-integration MAVEN version =10.0.0.Beta1, =5.0.0.Alpha6, =3.0.0.Beta17, =5.0.0.Alpha6, =3.0.0.Beta17, =13.0.0.Beta1, =5.0.0.Alpha6, =3.0.0.Beta22, =25.0.0.Final, =25.0.0.Final, =25.0.0.Final, =27.0.0.Alpha2, =27.0.0.Final, =27.0.1.Final Source cves: CVE-2025-23368...

Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhp6-6p8p-2rqh. This link is maintained to preserve external references. Original Description A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to insufficient security measures in the authentication mechanism. An attacker can exploit this flaw to perform brute force attacks by repeatedly attempting to authenticate within a short time frame. Note: The...

GHSA-3JXR-23PH-C89G Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhp6-6p8p-2rqh. This link is maintained to preserve external references. Original Description A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent...

CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368

CVE-2025-23368 relates to the Wildfly Elytron integration exposing a brute-force risk for CLI authentication. Red Hat’s advisory RHSA-2026:18059 (and CVE-2025-23368‑specific RHSA-2026:18059-CVE-2025-23368) fixes this in Red Hat JBoss Enterprise Application Platform 8.1.6 and WildFly Core updates....

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI...

CVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. Mitigation The effectiveness of an attack will also be...

Insufficient Verification Of Data Authenticity

org.wildfly:wildfly-elytron-oidc-client-subsystem is vulnerable to authorization code injection. The vulnerability is due to improper session handling that allows an attacker to inject a stolen authorization code into their own session with a victim's identity, typically through a Man-in-the-Midd...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the OIDC-Client subsystem. An attacker can impersonate a victim by injecting a stolen authorization code into their own session. Note: This is only exploitable if the following happens-...

de.gedoplan:baselibs-wildfly (=36.0.1_02), org.eclipse.jetty.documentation:code-examples (>=10.0.22 <=11.0.25) +18 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=2.3.0.Final <=2.6.1.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =2.3.0.Final, =10.0.22, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =26.0.0, =26.0.0, =26.0.0, =2.3.0.Final, =2.6.10.Final - org.wildfly.transaction:wildfly-transaction-client =3.0.5.Final and more Source cves: CVE-2024-12369 Sour...

io.hawt:hawtio-wildfly (=2.17.7), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +133 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=1.17.0.Final <=2.2.8.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =1.17.0.Final, =0.1.0, =9.4.45.v20220203, =9.4.45.v20220203, =9.4.45.v20220203, =10.0.8, =12.0.1, =12.0.1, =12.0.1, =10.0.10, =13.0.0.CR1, =3.1.0.Final, =3.1.1.Alpha1 - org.jboss.resteasy.spring:galleon-feature-pack-layers-metadata-test...

Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5565-3c98-g6jc. This link is maintained to preserve external references. Original Description A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the...

CVE-2024-7341 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...