5.3
Moyenne
CVE-2026-19625 When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1"…
Description
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Enterprise Build of Quarkus 3.33 | 3.33.1 → 3.33.3 | Pas de correctif indiqué |
| Enterprise Build of Quarkus 3.27 | 3.27.1 → 3.27.5 | Pas de correctif indiqué |
Autres CVE de Enterprise Build of Quarkus
Les 4 CVE de Enterprise Build of Quarkus →
CVE-2026-77874
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection
8.6
Élevée
CVE-2026-19651
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass…
7.4
Élevée
CVE-2026-16308
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a…
7.5
Élevée