CVE-2026-19625

Received Received - Intake

Authentication Bypass in Quarkus OIDC Provider

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: IBM Corporation

Description

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-19625

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves a Quarkus application with multiple OIDC-secured endpoints. When token introspection caching is enabled, a valid token for one endpoint can unintentionally grant access to another endpoint secured by a different OIDC provider.

Impact Analysis

An attacker could use a stolen or legitimate token from one endpoint to access another endpoint it shouldn't, potentially exposing sensitive data or performing unauthorized actions across different secured paths.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating principles of least privilege and data protection required by GDPR and HIPAA, potentially resulting in compliance breaches and legal penalties.

Mitigation Strategies

Disable the optional token introspection cache in your Quarkus application configuration to prevent token reuse across different OIDC provider tenants.

Hi! I’m here to help you understand CVE-2026-19625. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70