Skip to content
OpenAdvisories
High · 7.4 CVE-2026-19611 EUVD-2026-63478GHSA-h79m-h3j4-r7qm

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Published Aug 20, 2026 · Updated Nov 6, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Build of Apache Camel 3.33.3.SP2 Product: Red Hat build of Apache Camel 4 for Quarkus 3 Product: Red Hat build of Debezium 3 Product: Red Hat Build of Debezium 3.6 Product: Red Hat build of Keycloak 26.4 Product: Red Hat build of Keycloak 26.4.17 Product: Red Hat build of Keycloak 26.6 Product: Red Hat build of Keycloak 26.6.8 Product: Red Hat build of Quarkus 3.27.5.SP2 Product: Red Hat build of Quarkus 3.33.3.SP2 Product: Red Hat Data Grid 8 Product: Red Hat JBoss Enterprise Application Platform 7 Product: Red Hat JBoss Enterprise Application Platform 8.1 Product: Red Hat JBoss Enterprise Application Platform Expansion Pack Product: Red Hat Single Sign-On 7 Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Ecosystem: Wolfi

Description

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 — —
Red Hat Red Hat Build of Debezium 3.6 — —
Red Hat Red Hat build of Keycloak 26.4 — —
Red Hat Red Hat build of Keycloak 26.4.17 — —
Red Hat Red Hat build of Keycloak 26.6 — —
Red Hat Red Hat build of Keycloak 26.6.8 — —
Red Hat Red Hat build of Quarkus 3.27.5.SP2 — —
Red Hat Red Hat build of Quarkus 3.33.3.SP2 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 — —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 — —
Red Hat Red Hat build of Debezium 3 — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Single Sign-On 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling keycloak-26.6 +1 26.6.7-r3 —

References