Currently org.wildfly.security.mechanism.scram.ScramServer uses simple byte comparison to verify the message nonce and client proof.
Simple byte comparison returns on the first mismatch and is therefore susceptible to timing attacks.

java.security.MessageDigest#isEqual(byte[],byte[]) should be used to compare message nonces and client proofs in constant time.