GHSA-qhp6-6p8p-2rqh

Suggest an improvement
Source
https://github.com/advisories/GHSA-qhp6-6p8p-2rqh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qhp6-6p8p-2rqh/GHSA-qhp6-6p8p-2rqh.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qhp6-6p8p-2rqh
Aliases
Published
2026-02-13T20:52:26Z
Modified
2026-02-13T22:41:05Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Wildfly Elytron integration susceptible to brute force attacks via CLI
Details

Impact

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Patches

The default behaviour has been changed in WildFly Core 31.0.3.Final, and 32.0.0.Beta3 - the first version is used by WildFly 39.0.1.Final and the second will be included in WildFly 40.

Workarounds

No direct workaround. Monitoring network traffic / blocking suspicious traffic may help.

References

https://www.cve.org/CVERecord?id=CVE-2025-23368 https://issues.redhat.com/browse/WFCORE-7192

Acknowledgements

We would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-307"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-13T20:52:26Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

Maven / org.wildfly.core:wildfly-elytron-integration

Package

Name
org.wildfly.core:wildfly-elytron-integration
View open source insights on deps.dev
Purl
pkg:maven/org.wildfly.core/wildfly-elytron-integration

Affected ranges

Type
ECOSYSTEM
Events
Introduced
32.0.0.Beta1
Fixed
32.0.0.Beta3

Affected versions

32.*
32.0.0.Beta1
32.0.0.Beta2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qhp6-6p8p-2rqh/GHSA-qhp6-6p8p-2rqh.json"

Maven / org.wildfly.core:wildfly-elytron-integration

Package

Name
org.wildfly.core:wildfly-elytron-integration
View open source insights on deps.dev
Purl
pkg:maven/org.wildfly.core/wildfly-elytron-integration

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
31.0.3.Final

Affected versions

3.*
3.0.0.Beta12
3.0.0.Beta13
3.0.0.Beta14
3.0.0.Beta15
3.0.0.Beta16
3.0.0.Beta17
3.0.0.Beta18
3.0.0.Beta19
3.0.0.Beta20
3.0.0.Beta21
3.0.0.Beta22
3.0.0.Beta23
3.0.0.Beta24
3.0.0.Beta25
3.0.0.Beta26
3.0.0.Beta27
3.0.0.Beta28
3.0.0.Beta29
3.0.0.Beta30
3.0.0.Beta31
3.0.0.CR1
3.0.0.Final
3.0.1.Final
3.0.2.CR1
3.0.2.Final
3.0.3.Final
3.0.4.Final
3.0.5.Final
3.0.6.Final
3.0.7.Final
3.0.8.Final
3.0.9.Final
3.0.10.Final
3.1.0.Final
4.*
4.0.0.Alpha1
4.0.0.Alpha2
4.0.0.Alpha3
4.0.0.Alpha4
4.0.0.Alpha5
4.0.0.Alpha6
4.0.0.Alpha7
4.0.0.Alpha8
4.0.0.Alpha9
4.0.0.Alpha10
4.0.0.Beta1
4.0.0.Beta2
4.0.0.CR1
4.0.0.Final
5.*
5.0.0.Alpha1
5.0.0.Alpha2
5.0.0.Alpha3
5.0.0.Alpha4
5.0.0.Alpha5
5.0.0.Alpha6
5.0.0.Alpha7
5.0.0.Beta1
5.0.0.Beta2
5.0.0.Beta3
5.0.0.Beta4
5.0.0.Beta5
5.0.0.CR1
5.0.0.Final
6.*
6.0.0.Alpha1
6.0.0.Alpha2
6.0.0.Alpha3
6.0.0.Alpha4
6.0.0.Alpha5
6.0.0.Beta1
6.0.0.CR1
6.0.0.CR2
6.0.0.CR3
6.0.0.CR4
6.0.0.Final
6.0.1.Final
6.0.2.Final
7.*
7.0.0.Alpha1
7.0.0.Alpha2
7.0.0.Alpha3
7.0.0.Alpha4
7.0.0.Alpha5
7.0.0.Beta1
7.0.0.CR1
7.0.0.Final
8.*
8.0.0.Beta1
8.0.0.Beta2
8.0.0.Beta3
8.0.0.Beta4
8.0.0.Beta5
8.0.0.CR1
8.0.0.Final
9.*
9.0.0.Beta1
9.0.0.Beta2
9.0.0.Beta3
9.0.0.Beta4
9.0.0.Beta5
9.0.0.Beta6
9.0.0.Beta7
9.0.0.Final
9.0.1.Final
9.0.2.Final
10.*
10.0.0.Beta1
10.0.0.Beta2
10.0.0.Beta3
10.0.0.Beta4
10.0.0.Beta5
10.0.0.Beta6
10.0.0.Beta7
10.0.0.Beta8
10.0.0.Beta9
10.0.0.CR1
10.0.0.Final
10.0.2.Final
10.0.3.Final
11.*
11.0.0.Beta1
11.0.0.Beta2
11.0.0.Beta3
11.0.0.Beta4
11.0.0.Beta5
11.0.0.Beta6
11.0.0.Beta7
11.0.0.Beta8
11.0.0.Beta9
11.0.0.Beta10
11.0.0.Final
11.1.0.Final
11.1.1.Final
12.*
12.0.0.Beta1
12.0.0.Beta2
12.0.0.Beta3
12.0.0.Beta4
12.0.0.Final
12.0.1.Final
12.0.3.Final
13.*
13.0.0.Beta1
13.0.0.Beta2
13.0.0.Beta3
13.0.0.Beta4
13.0.0.Beta5
13.0.0.Beta6
13.0.0.Final
13.0.1.Final
13.0.2.Final
13.0.3.Final
14.*
14.0.0.Beta1
14.0.0.Beta2
14.0.0.Beta3
14.0.0.Beta4
14.0.0.Beta5
14.0.0.Final
14.0.1.Final
15.*
15.0.0.Beta1
15.0.0.Final
15.0.1.Final
16.*
16.0.0.Beta1
16.0.0.Beta2
16.0.0.Beta3
16.0.0.Beta4
16.0.0.Beta5
16.0.0.Final
16.0.1.Final
17.*
17.0.0.Beta1
17.0.0.Beta2
17.0.0.Beta3
17.0.0.Beta4
17.0.0.Beta5
17.0.0.Beta6
17.0.0.Beta7
17.0.0.Final
17.0.1.Final
17.0.2.Final
17.0.3.Final
18.*
18.0.0.Beta1
18.0.0.Beta2
18.0.0.Beta3
18.0.0.Beta4
18.0.0.Beta5
18.0.0.Final
18.0.1.Final
18.0.2.Final
18.0.3.Final
18.0.4.Final
18.1.0.Beta1
18.1.0.Final
18.1.1.Final
18.1.2.Final
19.*
19.0.0.Beta1
19.0.0.Beta2
19.0.0.Beta3
19.0.0.Beta5
19.0.0.Beta6
19.0.0.Beta7
19.0.0.Beta8
19.0.0.Beta9
19.0.0.Beta10
19.0.0.Beta11
19.0.0.Beta12
19.0.0.Beta13
19.0.0.Beta14
19.0.0.Beta15
19.0.0.Beta17
19.0.0.Beta18
19.0.0.Final
19.0.1.Final
20.*
20.0.0.Beta1
20.0.0.Beta2
20.0.0.Beta3
20.0.0.Beta4
20.0.0.Beta5
20.0.0.Beta6
20.0.0.Beta7
20.0.0.Beta8
20.0.0.Final
20.0.1.Final
20.0.2.Final
21.*
21.0.0.Beta1
21.0.0.Beta2
21.0.0.Beta3
21.0.0.Beta4
21.1.0.Beta1
21.1.0.Beta2
21.1.0.Final
21.1.1.Final
22.*
22.0.0.Beta1
22.0.0.Beta2
22.0.0.Beta3
22.0.0.Final
22.0.1.Final
22.0.2.Final
23.*
23.0.0.Beta1
23.0.0.Beta2
23.0.0.Beta3
23.0.0.Beta4
23.0.0.Beta5
23.0.0.Final
23.0.1.Final
23.0.2.Final
23.0.3.Final
24.*
24.0.0.Beta1
24.0.0.Beta2
24.0.0.Beta3
24.0.0.Final
24.0.1.Final
25.*
25.0.0.Beta1
25.0.0.Beta2
25.0.0.Beta3
25.0.0.Beta4
25.0.0.Beta5
25.0.0.Final
25.0.1.Final
25.0.2.Final
26.*
26.0.0.Beta1
26.0.0.Beta2
26.0.0.Beta3
26.0.0.Beta4
26.0.0.Beta5
26.0.0.Final
26.0.1.Final
27.*
27.0.0.Beta1
27.0.0.Beta2
27.0.0.Beta3
27.0.0.Beta4
27.0.0.Beta5
27.0.0.Beta6
27.0.0.Beta7
27.0.0.Final
27.0.1.Final
28.*
28.0.0.Beta1
28.0.0.Beta2
28.0.0.Beta3
28.0.0.Beta4
28.0.0.Beta5
28.0.0.Beta6
28.0.0.Final
28.0.1.Final
29.*
29.0.0.Beta1
29.0.0.Beta2
29.0.0.Beta3
29.0.0.Beta4
29.0.0.Beta5
29.0.0.Beta6
29.0.0.Final
29.0.1.Final
30.*
30.0.0.Beta1
30.0.0.Beta2
30.0.0.Beta3
30.0.0.Beta4
30.0.0.Final
31.*
31.0.0.Beta1
31.0.0.Beta2
31.0.0.Beta3
31.0.0.Final
31.0.1.Final
31.0.2.Final

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qhp6-6p8p-2rqh/GHSA-qhp6-6p8p-2rqh.json"