CVE-2026-19611

Fixed in a distro release EPSS <1%CVSS 7.4

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

Published 2026-08-20 · CVE record · OSV

Products: Red Hat Build of Apache Camel 3.33.3.SP2, Red Hat Build of Debezium 3.6, Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7

Distro releases