Red Hat JBoss Enterprise Application Platform 8.0.7 addresses two security vulnerabilities: CVE-2024-12369, an OpenID Connect (OIDC) Authorization Code Injection vulnerability in the wildfly-elytron-oidc-client-subsystem, and CVE-2025-23367, an improper Role-Based Access Control (RBAC) permission issue in the wildfly-server component. These vulnerabilities could potentially allow unauthorized actions due to improper authorization controls. The update replaces version 8.0.6 and includes additional bug fixes and component upgrades. Red Hat has rated the security impact as moderate and has released this update for JBoss EAP 8.0 on RHEL 8 and 9. The vendor advisory confirms the availability of an official fix and provides detailed instructions for applying the update.

The vulnerabilities could allow an attacker to exploit authorization weaknesses in the OIDC client subsystem and RBAC permissions in Wildfly, potentially leading to unauthorized access or actions within the application platform. However, no known exploits in the wild have been reported. The overall security impact is rated as moderate by Red Hat Product Security.

An official security update is available in Red Hat JBoss Enterprise Application Platform 8.0.7, which fixes the identified vulnerabilities. Users should apply this update after ensuring all previously released errata are applied and backing up their existing installations, including applications, configuration files, and databases. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.