This advisory covers two security vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9. The first is CVE-2024-12369, an OIDC Authorization Code Injection vulnerability in the wildfly-elytron-oidc-client-subsystem. The second is CVE-2025-23367, an improper Role-Based Access Control (RBAC) permission issue in the wildfly-server component. These vulnerabilities could allow unauthorized actions related to authorization and access control within the platform. Red Hat has released version 8.0.7 of JBoss EAP 8.0 to address these issues, replacing version 8.0.6. The advisory does not provide detailed CVSS metrics but rates the severity as moderate.

The vulnerabilities impact authorization and access control mechanisms in Red Hat JBoss Enterprise Application Platform 8.0, potentially allowing attackers to bypass intended restrictions or inject authorization codes improperly. This could lead to unauthorized access or privilege escalation within affected deployments. The overall security impact is rated moderate by Red Hat Product Security. There are no known exploits in the wild at the time of this advisory.

A security update to Red Hat JBoss Enterprise Application Platform 8.0.7 is available and should be applied to affected systems. Before updating, ensure all previously released errata are applied and back up existing installations, including applications and configurations. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are specified beyond applying this update.