EUVD-2026-63478
GHSA-h79m-h3j4-r7qm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV:N because auth endpoints are network-exposed; AC:H because attacker must identify accounts with fullwidth passwords and map them; PR:N as no prior auth is required; C:H/I:H for full account takeover; A:N as no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
AnalysisAI
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing, collapsing fullwidth characters (e.g., U+FF21 'Ａ') to their ASCII equivalents (e.g., 'A'). This allows an unauthenticated remote attacker to authenticate against accounts whose owners believed their passwords contained unique non-ASCII characters by submitting a standard ASCII-only dictionary - the normalization makes the stored hash indistinguishable from its ASCII equivalent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim account's password must have been set using one or more fullwidth Unicode characters (Unicode block U+FF01-U+FF60, Halfwidth and Fullwidth Forms), which are canonically mapped to ASCII by NFKC normalization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N scores 7.4 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-19611 and Red Hat Bugzilla BZ#2514568 for patched package versions across each affected product stream; no specific fixed version number was confirmed in the provided data, so citing one would be speculative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Red Hat JBoss EAP 7, JBoss EAP 8, Red Hat Build of Keycloak, Red Hat Data Grid 8, or other Red Hat middleware products that use Elytron, documenting their criticality and network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-173 – Improper Handling of Alternate Encoding
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today