CyberRota Analysis
AI-GeneratedA vulnerability exists in WildFly Elytron where password hashing and verification processes improperly normalize input using Unicode NFKC, allowing fullwidth characters to be collapsed into ASCII equivalents. This flaw enables remote attackers to exploit accounts with passwords that were intended to include non-ASCII characters, significantly increasing the likelihood of successful password guessing attacks. Organizations utilizing WildFly Elytron should prioritize remediation to protect against potential unauthorized access.
Original NVD Description
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.