When WildFly Elytron normalizes password input using NFKC, it silently collapses the entropy of any password containing fullwidth Unicode characters. A user typing a fullwidth 'Ａ' (U+FF21) believing they are adding dictionary-defying complexity is actually getting stored as a plain ASCII 'A' — identical to any other 'A' in the character set. The system has done exactly what security guidance prescribes: applied NFKC normalization to prevent homograph attacks and standardize input. But for passwords, this is entropy suicide dressed as security hygiene.
You cannot detect this failure from outside the library. The user sees their fullwidth password accepted. The operator sees a compliant password policy passing normal validation checks. The application logs show successful authentication with no anomalies. Only the attacker benefits: they now have an ASCII-only dictionary attack against passwords users believed were Unicode-hardened. This is the core invisibility problem — the failure announces itself to no one except the party exploiting it.
If you operate WildFly Elytron or any Jakarta Security implementation, verify whether your password storage pipeline performs Unicode normalization. The fix is removing the normalization step entirely or making it opt-in with explicit documentation about the entropy implications. Beyond this specific CVE, treat any library that silently normalizes credential input as a high-risk component: audit its behavior, document the entropy properties it guarantees, and assume that invisible transformations on credentials are hostile until proven harmless. The lesson extends to API tokens, session identifiers, and any other secret where character identity maps directly to entropy.