CVE-2026-19625
IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.
| CWE | CWE-284 |
| Vendor | ibm |
| Product | enterprise build of quarkus |
| Published | Sep 8, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm enterprise build of quarkus
Be the first to know when new medium vulnerabilities affecting ibm enterprise build of quarkus are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
IBM / Enterprise Build of Quarkus
3.27.1 ≤ 3.27.5 3.33.1 ≤ 3.33.3
Credits
Michael Read (https://github.com/Michael-JRead) , Michael Read (https://github.com/Michael-JRead)