Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Summary

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

Timeline

1. Aug 20, 2026, 3:58 PM UTCCVE published
2. Aug 21, 2026, 4:38 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 15, 2026, 5:01 PM UTCRecord last updated

Affected versions

• org.wildfly.security/wildfly-elytron-password-impl

  Version range not reported

• Red Hat Red Hat Build of Debezium 3.6

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• keycloak/rhbk-openshift-rhel9

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• jboss-eap-7/eap74-els-openjdk17-openshift-rhel8

  Version range not reported

• jboss-eap-7/eap74-els-openjdk8-openshift-rhel8

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

• wildfly-elytron-password-impl

  Version range not reported

References 6