CVE-2025-23368

HighCVSS 8.1

Published: 04/03/2025(UTC)Updated: 17/08/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.85%

55th percentile - higher than 55% of all known CVEs

Summary

The Wildfly Elytron integration lacks sufficient measures to prevent multiple failed authentication attempts within a short time frame. This flaw makes the CLI more susceptible to brute force attacks.

Risk Assessment

The organization faces an increased risk of administrative account compromise through brute force attacks on the CLI, potentially leading to unauthorized server and data access.

Recommendation

Immediately update Wildfly Elytron to a patched version and implement additional security measures such as account lockout after a defined number of failed login attempts.

Other vulnerabilities in Wildfly Elytron

CVE-2026-19611High
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords using an ASCII-only dictionary, leading to unauthorized access.

Original NVD description (English source)

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.