Red HatCVE-2026-19611
A flaw was found in WildFly Elytron
High7.4CVE-2026-19611 · Published Aug 20, 2026 · updated Sep 21, 2026
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Data Grid 8 Product | all versions | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet | |
| Red Hat JBoss Enterprise Application Platform 8 Product | all versions | No fix yet |
| Red Hat JBoss Enterprise Application Platform Expansion Pack Product | all versions | No fix yet |
| Red Hat Single Sign-On 7 Product | all versions | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 Product | all versions | No fix yet |
| Red Hat build of Debezium 3 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-173
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 20 | Red Hat multicloud-operators-subscription: information disclosure | High7.7 | No fix yet |
| Aug 20 | A flaw was found in the multicloud-operators-subscription component | Critical9.9 | No fix yet |
| Aug 20 | Red Hat Advanced Cluster Management for Kubernetes 2: information disclosure | Low2.5 | No fix yet |
| Aug 20 | Red Hat lighthouse: information disclosure | Medium5.4 | No fix yet |
| Aug 20 | Red Hat Lighthouse. A remote attacker: privilege escalation | Low3.7 | No fix yet |
| Aug 20 | A flaw was found in Kata Containers | High8.1 | No fix yet |