An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development.
Acknowledgments: Name: Jean-marie Bourbon (Excellium-Services), Anthony Maia (Excellium-Services)
Statement: Red Hat Product Security does not consider this issue to be a vulnerability. The default installation are by default secured and set to have an authentication mechanism in place. It is possible to explicitly remove the realm from the configuration files when needed. For example, in case there's need to run in single user mode for development use, ability to switch off security is desirable so the admin console can be accessed without the need for user accounts. There is adequate mechanism in place to secure the WildFly environment.