Credential Guessing Vulnerability via WildFly Elytron Unicode Normalization

A vulnerability (CVE-2026-19611) exists within the WildFly Elytron framework, which is utilized across multiple Red Hat middleware and security products. The flaw stems from the password hashing and verification processes performing Unicode NFKC normalization on input. This process collapses specific fullwidth characters into their ASCII equivalents. Because the system treats these transformed characters as identical to standard ASCII characters, an attacker can bypass the intended complexity of passwords that include non-ASCII characters. By leveraging an ASCII-only wordlist, an attacker can more effectively guess the password for a targeted account, significantly reducing the search space required for a successful brute-force or credential-stuffing attack. This vulnerability affects numerous enterprise products, including Keycloak, JBoss EAP, and Quarkus-based builds, and requires organizations to audit their authentication flows for impact.

Impact

The vulnerability carries a CVSS 3.1 score of 7.4 (High). If successfully exploited, an unauthorized actor could gain access to protected services and data by brute-forcing credentials that were previously considered strong due to their inclusion of non-ASCII characters. The scope of impact extends to any environment using affected Red Hat middleware for authentication, potentially exposing enterprise-grade identity and access management systems.

Recommendation

• Identify all instances of affected Red Hat products within the infrastructure (e.g., Keycloak, Data Grid 8, JBoss EAP 7).
• Apply security patches provided by Red Hat as soon as they become available for the affected wildfly-elytron-password-impl package.
• Implement rate limiting and account lockout policies for all authentication endpoints to mitigate the risk of automated credential guessing attacks.
• Review authentication logs for anomalous spikes in failed login attempts, particularly those originating from single IP addresses, which may indicate automated dictionary-based attempts targeting this vulnerability.