CVE-2026-19611

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

View on CVE.org
Published Aug 20, 2026 CVSS 3.1 · 7.4 High EPSS 1.0% KEV · Not listed
Description
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

Analysis

AI-generated

Technical impact

A Unicode Normalization Form Compatibility Composition (NFKC) bug in WildFly Elytron collapses fullwidth characters to their ASCII equivalents during password hashing and verification. This reduces the effective password keyspace, allowing an attacker to use ASCII‑only dictionaries to guess passwords that were intended to contain non‑ASCII characters. The weakness can lead to unauthorized account access, representing a significant confidentiality breach.

Affected Systems

Affected products include Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform versions 7 and 8 along with its Expansion Pack, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel 4 for Quarkus 3, Debezium 3, and Quarkus.

Risk and Exploitability

The CVSS score of 7.4 indicates a high severity, and while the EPSS score is not available, the lack of an immediate patch and the ease of using ASCII‑only dictionaries make exploitation plausible for a remote attacker. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet, but the underlying weakness—CWE‑173—highlights a critical password handling flaw. Attackers could target any exposed authentication interfaces that rely on WildFly Elytron, potentially gaining system access if proper countermeasures are not in place.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Upgrade to a patched Red Hat release as soon as it becomes available
  • Enforce a strong password policy that prohibits the use of non‑ASCII or fullwidth characters and requires a minimum length of 12 characters
  • Implement multi‑factor authentication for all administrative and privileged accounts
  • Activate account lockout or adaptive rate limiting after a configurable number of failed login attempts
  • No official CNA workaround is available; consider custom mitigations if necessary

Generated by OpenCVE AI on August 20, 2026 at 21:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.4::el9
cpe:/a:redhat:build_keycloak:26.6::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:debezium:3.6
References
Type Values Removed Values Added
First Time appeared Redhat apache Camel Quarkus
Redhat quarkus
CPEs cpe:/a:redhat:apache_camel_quarkus:3.33
cpe:/a:redhat:quarkus:3.27::el8
cpe:/a:redhat:quarkus:3.33::el8
Vendors & Products Redhat apache Camel Quarkus
Redhat quarkus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:quarkus:3
Vendors & Products Redhat quarkus
References
Type Values Removed Values Added
First Time appeared Redhat build Of Apache Camel For Quarkus
Redhat build Of Debezium 3
Redhat build Of Keycloak
Redhat build Of Quarkus
Redhat data Grid 8
Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat build Of Apache Camel For Quarkus
Redhat build Of Debezium 3
Redhat build Of Keycloak
Redhat build Of Quarkus
Redhat data Grid 8
Redhat jboss Enterprise Application Platform Expansion Pack
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Title Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
First Time appeared Redhat
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Redhat quarkus
Redhat red Hat Single Sign On
Weaknesses CWE-173
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:debezium:3
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Redhat quarkus
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Earlier changes (3)
Weaknesses
  • CWE-173

    Improper Handling of Alternate Encoding

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 6, 2026, 5:27 PM
Reserved
Aug 12, 2026, 11:04 AM

View source JSON

Updated
Aug 21, 2026, 4:38 PM

JSON

Status
Awaiting Analysis
Published
Aug 20, 2026, 4:17 PM
Modified
Nov 6, 2026, 6:18 PM

View source JSON

No data.

Updated
Aug 21, 2026, 9:15 PM

JSON