CVE-2026-19625 — IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

CVE-2026-19625

IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities PUBLISHED

Description (CNA)

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

Affected (CNA)

Vendor / product	Versions
IBM / Enterprise Build of Quarkus	affected 3.27.1 through 3.27.5; affected 3.33.1 through 3.33.3

CWE

CWE-284

References

https://www.ibm.com/support/pages/node/7286498

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.