5.3
Medium
CVE-2026-19625 When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1"…
Description
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Enterprise Build of Quarkus 3.33 | 3.33.1 → 3.33.3 | No fix stated |
| Enterprise Build of Quarkus 3.27 | 3.27.1 → 3.27.5 | No fix stated |
Other CVEs of Enterprise Build of Quarkus
The 4 CVEs of Enterprise Build of Quarkus →
CVE-2026-77874
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection
8.6
High
CVE-2026-19651
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass…
7.4
High
CVE-2026-16308
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a…
7.5
High