{"id":"CVE-2026-19611","title":"A flaw was found in WildFly Elytron","summary":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using a…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-173"],"vendor":"Red Hat","product":"org.wildfly.security/wildfly-elytron-password-impl","affected":["org.wildfly.security/wildfly-elytron-password-impl (all versions)","build_of_debezium_3.6","wildfly-elytron-password-impl","wildfly-elytron-password-impl","wildfly-elytron-password-impl (all versions)","wildfly-elytron-password-impl (all versions)","keycloak/rhbk-openshift-rhel9 (all versions)","wildfly-elytron-password-impl (all versions)","wildfly-elytron-password-impl (all versions)","jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)","wildfly-elytron-password-impl (all versions)","wildfly-elytron-password-impl (all versions)","wildfly-elytron-password-impl","wildfly-elytron-password-impl (all versions)"],"patched":["build_of_apache_camel 3.33.3.SP2","build_of_quarkus 3.27.5.SP2","build_of_quarkus 3.33.3.SP2"],"published":"2026-08-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T17:17:21.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19611","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:69440","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69470","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:70257","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:83612","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19611","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514568","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19611.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19611"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19611"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-08-21T16:38:31.494304Z"},"epss":0.00894,"epssPercentile":0.59289,"ingestedAt":"2026-09-21T17:49:53.182Z","slug":"CVE-2026-19611","body":"## Overview\n\nA flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19611.json)\n- **RHSA-2026:70257** · Red Hat · fixed in: Red Hat Build of Apache Camel 3.33.3.SP2 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70257)\n- **RHSA-2026:69470** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.5.SP2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69470)\n- **RHSA-2026:69440** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.3.SP2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69440)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}