{"id":"CVE-2026-19611","aliases":["EUVD-2026-63478","GHSA-h79m-h3j4-r7qm"],"status":"published","title":"Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding","description":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01035,"percentile":0.64109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-173"],"published":"2026-08-20T15:58:24Z","modified":"2026-11-06T17:27:14Z","products":[{"vendor":"red hat","product":"red hat build of apache camel 3.33.3.sp2"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of debezium 3.6"},{"vendor":"red hat","product":"red hat build of keycloak 26.4"},{"vendor":"red hat","product":"red hat build of keycloak 26.4.17"},{"vendor":"red hat","product":"red hat build of keycloak 26.6"},{"vendor":"red hat","product":"red hat build of keycloak 26.6.8"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.5.sp2"},{"vendor":"red hat","product":"red hat build of quarkus 3.33.3.sp2"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat single sign-on 7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:69440","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70257","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83612","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95759","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95760","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95761","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95762","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95887","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19611","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514568","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19611"},{"url":"https://github.com/advisories/GHSA-h79m-h3j4-r7qm"}],"sources":{"cve":[{"id":"CVE-2026-19611","title":"Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding","description":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.","status":"published","published":"2026-08-20T15:58:24.19Z","modified":"2026-11-06T17:27:14.392Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-173"],"updated_at":"2026-11-06T18:59:08.498645Z"}],"euvd":[{"id":"EUVD-2026-63478","description":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.","status":"published","published":"2026-08-20T15:58:24Z","modified":"2026-11-06T17:27:14Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-06T18:05:39.47551Z"}],"ghsa":[{"id":"GHSA-h79m-h3j4-r7qm","title":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with...","description":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.","status":"published","published":"2026-08-20T18:30:52Z","modified":"2026-11-06T18:35:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-173"],"updated_at":"2026-11-06T19:01:27.658277Z"}],"nvd":[{"id":"CVE-2026-19611","description":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.","status":"published","published":"2026-08-20T16:17:18.293Z","modified":"2026-11-06T18:18:10.907Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-173"],"updated_at":"2026-11-06T20:01:13.158084Z"}]}}