WildFly Elytron CVE-2026-19611

The victim account's password must have been set using one or more fullwidth Unicode characters (Unicode block U+FF01-U+FF60, Halfwidth and Fullwidth Forms), which are canonically mapped to ASCII by NFKC normalization. Accounts using only standard ASCII passwords, or Unicode characters outside the NFKC-collapsing ranges (e.g., accented Latin, CJK ideographs, emoji), are not affected by this specific normalization collapse. The attacker requires no prior authentication and no foothold on the server (AV:N, PR:N), but must have network access to an authentication endpoint (login form, API, SAML/OIDC flow) exposed by the affected product. Exploitation is limited by: the attacker needing prior knowledge or accurate inference that a target account's password contains fullwidth characters; the attacker constructing a correctly mapped ASCII wordlist (AC:H); and the affected product being configured to use Elytron-managed credential storage rather than an external IdP.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N scores 7.4 (High). The network attack vector and absence of required privileges or user interaction are serious signals, but AC:H correctly reflects a meaningful constraint: the attacker must independently know - or enumerate - which accounts have passwords containing fullwidth Unicode characters, then generate the corresponding ASCII-mapped wordlist. In most Western-facing enterprise deployments, fullwidth-character passwords are uncommon, which naturally limits the exploitable population. Deployments serving East Asian user bases or those that historically accepted fullwidth input via web forms face a materially higher realistic risk. No EPSS data was provided, preventing probabilistic exploitation likelihood comparison. No CISA KEV listing and no known POC exist, indicating this is not currently observed in active mass exploitation campaigns. Despite C:H and I:H impact (full authentication bypass leading to account takeover), the real-world priority is moderate for most organizations and elevated for Keycloak or JBoss EAP environments with diverse Unicode user populations. EPSS data is absent from the provided intelligence - real-world exploitation probability cannot be quantified from available signals.

An attacker targeting a JBoss EAP or Keycloak deployment obtains a list of usernames (via enumeration, OSINT, or a prior breach). They identify accounts likely to have fullwidth Unicode passwords - for example, users who registered through a Japanese-language UI - and generate a standard ASCII wordlist where each password candidate maps the fullwidth version of the user's likely password to plain ASCII. Submitting these candidates against the authentication endpoint succeeds because Elytron's NFKC normalization makes the stored hash match. No public POC has been identified, but the technique requires only standard dictionary tooling and Unicode mapping tables.