This advisory addresses two security vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0.7. The first is an OIDC Authorization Code Injection vulnerability in the wildfly-elytron-oidc-client-subsystem (CVE-2024-12369), and the second is an improper Role-Based Access Control (RBAC) permission issue in the wildfly-server component (CVE-2025-23367). These issues could potentially allow unauthorized actions or privilege escalation within the affected platform. The update to version 8.0.7 replaces 8.0.6 and includes these security fixes along with other bug fixes and component upgrades. Red Hat rates the security impact as moderate and recommends applying this update after ensuring all prior errata are applied and backing up existing installations.

The vulnerabilities fixed in this update could allow an attacker to exploit authorization code injection in the OIDC client subsystem or bypass RBAC permissions improperly enforced by Wildfly. This could lead to unauthorized access or privilege escalation within applications running on the affected platform. Red Hat classifies the overall security impact as moderate. There are no known exploits in the wild at this time.

A security update to Red Hat JBoss Enterprise Application Platform 8.0.7 is available and should be applied. Before updating, ensure all previously released errata relevant to your system are applied and back up your existing installation, including applications and configuration. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258. This update replaces version 8.0.6 and includes the necessary security fixes. No additional mitigation steps are indicated by the vendor.