CVE-2026-19625: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Enterprise Build of Quarkusto a version that resolves this vulnerability.Fixed in 3.27.5.SP1 - Upgrade
Upgrade
IBM Enterprise Build of Quarkusto a version that resolves this vulnerability.Fixed in 3.33.3.SP1 - Configuration
If your Quarkus application has multiple endpoints each secured by separate OIDC provider tenants (e.g., /oidc-provider1 and /oidc-provider2), and optional token introspection cache is enabled, disable token introspection cache to prevent a valid token from one OIDC provider being usable across other provider-secured endpoints.
Quarkus token introspection cache = disable
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are Quarkus applications that use multiple endpoints secured by individual OIDC provider tenants and have the optional token introspection cache enabled. A single-provider setup or a deployment without that cache is not identified as affected by the provided information.
What does an attacker need to exploit this issue?
An attacker needs a valid token issued by one configured OIDC provider that is authorized for that provider's endpoint. They can then use that token against an endpoint protected by a different OIDC provider tenant.
What is the security impact?
The issue can allow unauthorized access across OIDC tenant boundaries: a token valid for one provider's protected endpoint may be accepted by another provider's endpoint. The supplied severity vector indicates network exploitation requires no privileges or user interaction and affects confidentiality, with no stated integrity or availability impact.