CVE-2026-19611
Received Received - Intake

Password Normalization Bypass in WildFly Elytron

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: redhat-SADP

Description
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-19611
EUVD
EUVD-2026-63478

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat wildfly_elytron *-*
redhat wildfly_elytron *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-173 The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WildFly Elytron's password hashing and verification by normalizing input using Unicode NFKC. This converts fullwidth characters to ASCII equivalents, reducing the password keyspace. Attackers can exploit this by using ASCII-only dictionaries to guess passwords that were intended to include non-ASCII characters.

Detection Guidance

To detect this vulnerability, check if WildFly Elytron's wildfly-elytron-password-impl component is installed and review password hashing configurations. Look for accounts using passwords with fullwidth characters (U+FF01–U+FF5E) that may have been normalized to ASCII equivalents during storage or verification.

Impact Analysis

If you use passwords containing fullwidth or non-ASCII characters in WildFly Elytron, they are stored and verified as ASCII equivalents. This makes passwords easier to guess via brute-force attacks using common ASCII dictionaries, potentially leading to unauthorized account access.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by weakening password security. If passwords containing non-ASCII characters are normalized to ASCII equivalents, the reduced keyspace makes brute-force attacks easier, potentially exposing sensitive data. GDPR requires strong security measures to protect personal data, while HIPAA mandates safeguards for protected health information. Weakened password hashing may fail to meet these standards.

Mitigation Strategies

No immediate mitigation steps are currently available per Red Hat. Avoid using fullwidth characters in passwords until a fix is released. Monitor Red Hat's advisories for updates on the wildfly-elytron-password-impl component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart