Description

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-20T16:17:18.293Z",
  "pubdate": "2026-08-20T16:17:18.293Z",
  "executiveSummary": "A vulnerability has been identified in WildFly Elytron involving improper input normalization during password hashing and verification processes. Specifically, the implementation applies Unicode Normalization Form KC (NFKC) to password inputs, which inadvertently collapses fullwidth characters and other compatibility variants down to their standard ASCII equivalents. This cryptographic weakness significantly reduces the effective keyspace for user accounts configured with passwords containing non-ASCII Unicode characters.\nThe primary impact of this flaw is unauthorized access resulting from weakened credential complexity. A remote attacker leveraging this normalization behavior can execute targeted authentication bypass or credential-guessing attacks. Instead of requiring a specialized dictionary encompassing the full spectrum of Unicode characters, an adversary can successfully compromise affected accounts by utilizing standard ASCII-only dictionaries.\nAffected systems comprise deployments of WildFly Elytron utilizing vulnerable password hashing and verification routines. The risk implication is heightened for environments where users rely on internationalized passwords containing fullwidth variants, assuming strong cryptographic entropy that does not actually exist in the processed hash state. Exploitation requires network access to the authentication interface and the capability to submit automated credential verification attempts, amplifying the exposure of systems lacking robust rate-limiting or account lockout mechanisms.",
  "technicalDetails": "The root cause of this vulnerability resides within the cryptographic credential processing pipeline of WildFly Elytron. During the execution of password hashing and verification functions, the vulnerable component normalizes all incoming plaintext password strings using the Unicode Normalization Form KC (NFKC) standard prior to applying hashing algorithms or performing string comparisons.\nUnicode NFKC normalization resolves compatibility equivalences, substituting characters such as fullwidth Latin letters, mathematical alphanumeric symbols, and various compatibility ligatures with their canonical ASCII decompositions. Consequently, if a user establishes a password containing non-ASCII fullwidth characters (e.g., fullwidth 'Ａ' through 'Ｚ'), the normalization routine transforms these inputs into standard ASCII characters (e.g., 'A' through 'Z') before the hash generation or verification evaluation occurs.\nThe attack flow proceeds as follows: First, an attacker identifies or infers that an account utilizes passwords potentially containing non-ASCII Unicode characters or fullwidth variants. Rather than attempting to brute-force the intended high-entropy Unicode keyspace, the adversary bypasses the extended character space entirely by constructing an ASCII-only attack payload. Second, the attacker submits crafted authentication requests or offline dictionary attack vectors using standard ASCII permutations that map identically under NFKC normalization. Third, because the WildFly Elytron verification routine normalizes the submitted ASCII input to match the stored hash generated from the normalized non-ASCII equivalent, authentication succeeds. This effectively reduces the attacker's search space from a massive Unicode combinatorial set to a standard, highly optimized ASCII dictionary space.\nThe vulnerability requires remote network exposure to the authentication endpoint managed by WildFly Elytron. Authentication requirements are bypassed or subverted in the sense that the attacker does not need prior valid credentials, but rather relies on standard credential-submission interfaces. Privilege requirements for the initial attack vector are minimal, typically requiring only standard remote unauthenticated access to the application's login or authentication mechanisms. Post-exploitation impact includes full unauthorized access to the application context corresponding to the compromised user account privileges."
}