quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache

cve CVE-2026-19625 2 sources, 2 claims · Watch

Red Hat writes:
quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache the claim

Severity they disagree: MEDIUM NVD
important Red Hat
CVSS they disagree: 5.3 NVD
8.7 Red Hat
Vendor: IBM NVD
Product: Enterprise Build of Quarkus NVD
CWE: CWE-284 NVD
CWE-524 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Why the CVSS differs

Metric	NVD	Red Hat
Attack vector AV	network N	network N
Attack complexity AC	low L	high H
Privileges required PR	none N	none N
User interaction UI	none N	none N
Scope S	unchanged U	changed C
Confidentiality C	low L	high H
Integrity I	none N	high H
Availability A	none N	none N

Each source scores the same vulnerability from what it judges the attack to need. The rows marked are where they judge it differently.

Timeline

2026-08-31	first spoke of it: quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache	Red Hat
2026-09-08	first spoke of it: When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.	NVD

What it is to other things

In words only, so not counted until a person confirms one:

affects	`ibm/enterprise_build_of_quarkus` NVD says “IBM · Enterprise Build of Quarkus”
made_by	`ibm` NVD says “IBM”

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

yes

An attacker can reliably run all of the kill chain's first four steps without a person.

receipt

Source: NVD
Its words: yes
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	yes
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

NVD

5.3

receipt

Source: NVD
Its words: 5.3
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

Red Hat

8.7

receipt

Source: Red Hat
Its words: 8.7
Read by: field:cvss3_score
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-19625",
  "CWE": "CWE-524",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2517693",
  "bugzilla_description": "quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache",
  "cvss3_score": "8.7",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-31T11:55:20Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-19625.json",
  "severity": "important"
}

—

CVSS vector

cvss_vector

not compared

NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

not compared

Red Hat

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

2026-10-06 13:01 UTC	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
2026-09-29 09:44 UTC	—

What the source handed over

{
  "CVE": "CVE-2026-19625",
  "CWE": "CWE-524",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2517693",
  "bugzilla_description": "quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache",
  "cvss3_score": "8.7",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-31T11:55:20Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-19625.json",
  "severity": "important"
}

—

CWE

cwe

different words

NVD

CWE-284

receipt

Source: NVD
Its words: CWE-284
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CWE-284
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

different words

Red Hat

CWE-524

receipt

Source: Red Hat
Its words: CWE-524
Read by: field:CWE
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-19625",
  "CWE": "CWE-524",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2517693",
  "bugzilla_description": "quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache",
  "cvss3_score": "8.7",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-31T11:55:20Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-19625.json",
  "severity": "important"
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	none
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Product

product

NVD

Enterprise Build of Quarkus

receipt

Source: NVD
Its words: Enterprise Build of Quarkus
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Enterprise Build of Quarkus
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

conflict

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	MEDIUM
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

medium

Severity

severity

conflict

Red Hat

important

A flaw that can easily compromise confidentiality, integrity or availability.

receipt

Source: Red Hat
Its words: important
Read by: field:severity
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-19625",
  "CWE": "CWE-524",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2517693",
  "bugzilla_description": "quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache",
  "cvss3_score": "8.7",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-31T11:55:20Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-19625.json",
  "severity": "important"
}

high

Status

status

NVD

Awaiting Analysis

receipt

Source: NVD
Its words: Awaiting Analysis
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	partial
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

IBM

receipt

Source: NVD
Its words: IBM
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	IBM
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3:*:*:*:*:*:*:*"
            ],
            "product": "Enterprise Build of Quarkus",
            "vendor": "IBM",
            "versions": [
              {
                "lessThanOrEqual": "3.27.5",
                "status": "affected",
                "version": "3.27.1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "3.33.3",
                "status": "affected",
                "version": "3.33.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@us.ibm.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as \"/oidc-provider1\" that is secured by the OIDC Provider 1 and \"/oidc-provider2\" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access \"/oidc-provider1\" can also be used to access \"/oidc-provider2\" that is secured by another OIDC Provider 2."
      }
    ],
    "id": "CVE-2026-19625",
    "lastModified": "2026-09-10T16:17:09.417",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "psirt@us.ibm.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-19625",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T19:16:31.069809Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T21:17:05.717",
    "references": [
      {
        "source": "psirt@us.ibm.com",
        "url": "https://www.ibm.com/support/pages/node/7286498"
      }
    ],
    "sourceIdentifier": "psirt@us.ibm.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-284"
          }
        ],
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache zetlyn/cve-redhat · 2026-08-31	cvss 8.7 cvss_vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N cwe CWE-524 severity important	source
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2. zetlyn/cve-nvd · 2026-09-08	automatable yes cvss 5.3 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cwe CWE-284 exploitation none product Enterprise Build of Quarkus severity MEDIUM status Awaiting Analysis technical_impact partial vendor IBM	source