Threats tagged 'ghsa-998f-p8vh-hwg6'

A vulnerability in Wildfly allows remote attackers to bypass authentication on IIOP EJB invocations due to the CSIv2 security interceptor accepting ITTPrincipalName identity assertions without verifying transport-level authentication. This enables pre-authentication attackers on port 3528 to impersonate any principal on IIOP-exposed @Remote EJBs. The issue requires non-default configurations enabling caller propagation without enforcing mutual TLS or mandatory authentication. Default configurations are not affected.