CVE-2025-23368
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.87%
- CWE
- CWE-307
- Published
- 2025-03-04
- Last modified
- 2026-09-14
Affected products
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA
Weakness type
Related vulnerabilities
- CVE-2025-64310 — EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attemp
- CVE-2026-32295 — JetKVM insufficient login rate limiting
- CVE-2026-32292 — GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting
- CVE-2025-46414 — EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts
- CVE-2026-33640 — Outline has a rate limit bypass that allows brute force of email login OTP
- CVE-2026-33419 — MinIO: LDAP login brute-force via user enumeration and missing rate limit
- CVE-2026-33152 — Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication
- CVE-2026-31904 — CTEK Chargeportal Improper Restriction of Excessive Authentication Attempts