PT-2025-9676 · Wildfly · Wildfly

Claudia Bartolini + 2 · Published 2025-03-04 · Updated 2026-05-29 · CVE-2025-23368

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wildfly (affected versions not specified)

Description A flaw was found in the Wildfly Elytron integration, where the component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. This makes it more susceptible to brute force attacks via the Command Line Interface (CLI).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-23368

GHSA-3JXR-23PH-C89G

GHSA-QHP6-6P8P-2RQH

Affected Products

Wildfly

References · 31

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=2337621 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23368 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:18059 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:18055 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-23368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23368 · Security Note
• https://access.redhat.com/errata/RHSA-2026:18054 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3jxr-23ph-c89g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhp6-6p8p-2rqh · Vendor Advisory
• https://github.com/wildfly/wildfly-core/commit/a6f9d7534aa44de741337756f8377ad3a81f7695 · Note
• https://github.com/wildfly/wildfly-core/commit/11e873031c522a0b36afb59880ce4dd59efd0bc0 · Note
• https://github.com/wildfly/wildfly-core · Note
• https://github.com/wildfly/wildfly-core/security/advisories/GHSA-qhp6-6p8p-2rqh · Note
• https://github.com/wildfly/wildfly-core/pull/6634 · Note