Executive brief
A security flaw in the Wildfly Elytron integration component allows attackers to perform brute-force password guessing attacks against the Command Line Interface (CLI). The software fails to limit the number of failed login attempts, which could allow an unauthorized user to eventually gain administrative access to the application server. This could lead to full system compromise, data theft, or service disruption.
Technical details
A vulnerability classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) exists in the Wildfly Elytron integration component. The root cause is a failure to implement rate-limiting or account lockout mechanisms for authentication attempts made via the Command Line Interface (CLI). An unauthenticated remote attacker can exploit this by sending a high volume of authentication requests over HTTP or SASL-exposed ports. While the attack complexity is rated high (likely due to the need for specific network access or configuration), a successful exploit allows for credential discovery and subsequent full unauthorized access to the management interface. The issue has been addressed in Red Hat JBoss EAP 8.1.6 and related updates.
Affected products
- Red Hat Wildfly Core (wildfly-elytron-integration) <= 27.0.0.Final
- Red Hat JBoss Enterprise Application Platform (EAP) 7.0.0, 8.0.0
Timeline
- 2025-01-14: other: Bug reported to Red Hat Bugzilla
- 2025-03-04: disclosed: Initial advisory publication
- 2026-02-13: other: Advisory withdrawn as duplicate of GHSA-qhp6-6p8p-2rqh
- 2026-05-18: patched: Red Hat released security updates (RHSA-2026:18054, RHSA-2026:18055, RHSA-2026:18059)