A Unicode Normalization Form Compatibility Composition (NFKC) bug in WildFly Elytron collapses fullwidth characters to their ASCII equivalents during password hashing and verification. This reduces the effective password keyspace, allowing an attacker to use ASCII‑only dictionaries to guess passwords that were intended to contain non‑ASCII characters. The weakness can lead to unauthorized account access, representing a significant confidentiality breach.

Affected products include Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform versions 7 and 8 along with its Expansion Pack, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel 4 for Quarkus 3, Debezium 3, and Quarkus.

The CVSS score of 7.4 indicates a high severity, and while the EPSS score is not available, the lack of an immediate patch and the ease of using ASCII‑only dictionaries make exploitation plausible for a remote attacker. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet, but the underlying weakness—CWE‑173—highlights a critical password handling flaw. Attackers could target any exposed authentication interfaces that rely on WildFly Elytron, potentially gaining system access if proper countermeasures are not in place.