The vulnerability resides in the Undertow AJP listener, which incorrectly accepts forged ssl_cert and is_ssl attributes without verifying them against a shared secret. This flaw allows an unauthenticated attacker with direct TCP connectivity to the AJP port to inject a forged X.509 certificate, thereby bypassing the CLIENT-CERT authentication mechanism. As a result, the attacker can gain unauthorized access to the application, effectively bypassing authentication controls without needing valid credentials. This vulnerability corresponds to CWE‑295, which describes weaknesses in authentication mechanisms where the system fails to properly verify the identity of a party, leading to unauthorized access.

Red Hat JBoss Enterprise Application Platform 7, 8, and the Enterprise Application Platform Expansion Pack are all affected by this flaw, as identified by Red Hat. The CNA does not specify which minor versions are vulnerable, so all versions listed are considered impacted until vendors release a patch.

The CVSS score of 7.4 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires direct network access to the AJP listener on port 8009 and the ability to craft AJP protocol messages; no user interaction or local privileges are needed. Because the flaw permits authentication bypass just by forging attributes, an attacker can exploit it remotely from any host with connectivity to the vulnerable port, making the vulnerability potentially exploitable in open or lightly protected environments.