CVE-2026-19611

HighCVSS 7.4

Published: 20/08/2026(UTC)Updated: 26/10/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.89%

59th percentile - higher than 59% of all known CVEs

Summary

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords using an ASCII-only dictionary, leading to unauthorized access.

Risk Assessment

User accounts with passwords containing non-ASCII characters are more vulnerable to dictionary attacks, potentially leading to unauthorized access to systems.

Recommendation

Update WildFly Elytron to a patched version and consider enforcing password policies that account for this vulnerability.

Other vulnerabilities in WildFly Elytron

CVE-2025-23368High
The Wildfly Elytron integration lacks sufficient measures to prevent multiple failed authentication attempts within a short time frame. This flaw makes the CLI more susceptible to brute force attacks.

Original NVD description (English source)

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS