CVE-2026-19611: Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Other sources
WildFly Elytron password implementations (wildfly-elytron-password-impl, all supported versions reported) apply Unicode Normalization Form KC (NFKC) in AbstractPasswordImpl.getNormalizedPasswordBytes() before hashing and verification (BCrypt, SCRAM, Unix crypts, and related). NFKC compatibility mapping collapses fullwidth Latin characters (e.g. U+FF01–U+FF5E) to their ASCII equivalents, so a password the user believed contained non-ASCII fullwidth characters is stored and verified as the ASCII form. An attacker can therefore match such passwords with an ASCII-only dictionary. This is older SASLprep-style processing; modern PRECIS OpaqueString (RFC 8265) uses NFC and does not width-map passwords. CWE-173.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which passwords are at increased risk?
Passwords intended to include fullwidth Unicode characters are affected because NFKC normalization can fold those characters into their ASCII equivalents. An attacker can target such accounts using an ASCII-only password dictionary.
What does an attacker need to exploit this issue?
The attacker needs remote access to an authentication endpoint and does not need prior privileges or user interaction. Exploitation requires guessing an affected password, and the attack complexity is rated high.
What is the practical impact if an affected password is guessed?
A successful attacker can authenticate as the affected account, resulting in unauthorized access. The reported impact includes high confidentiality and integrity impact, with no availability impact.