CVE-2026-19625 PUBLISHED

IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Assigner: ibm
Reserved: 12.08.2026 Published: 08.09.2026 Updated: 08.09.2026

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Enterprise Build of Quarkus
Versions	affected from 3.27.1 to 3.27.5 (incl.) affected from 3.33.1 to 3.33.3 (incl.)

Solutions

The issues are addressed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1. To update your project to IBM Enterprise Build of Quarkus 3.27.5.SP1 or 3.33.3.SP1, follow the instructions in the product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .

Credits

Michael Read (https://github.com/Michael-JRead) , Michael Read (https://github.com/Michael-JRead) finder

References

https://www.ibm.com/support/pages/node/7286498

Problem Types

CWE-284 Improper Access Control CWE