CVE-2026-114488: Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments with IIOP-exposed @Remote EJBs reachable through the IIOP listener on port 3528 are exposed. The issue applies to every such EJB because an attacker can impersonate any principal.
What does an attacker need to exploit this?
An attacker needs network access to the IIOP service on port 3528. No prior authentication or user interaction is required, although exploitation is rated as high complexity.
What is the security impact?
A remote pre-auth attacker can bypass authentication by supplying an ITTPrincipalName identity assertion accepted by the CSIv2 interceptor without transport-level authentication. This can result in high confidentiality and integrity impact through impersonation of arbitrary principals.