EUVD-2026-74190Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
PR:L because a valid token from one OIDC provider is required; AC:H because both multi-tenant OIDC and optional introspection cache must be co-configured.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.
AnalysisAI
Token introspection cache in multi-tenant Quarkus OIDC configurations permits cross-tenant authorization bypass, allowing a bearer token issued by one OIDC provider to authenticate against endpoints secured by a different, independent OIDC provider. Affected are Enterprise Build of Quarkus versions 3.27.1-3.27.5 and 3.33.1-3.33.3 when both multi-tenant OIDC routing and the optional token introspection cache are active simultaneously. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to be simultaneously true: (1) the Quarkus application is configured with multiple OIDC provider tenants, each protecting distinct URL path prefixes; (2) the optional token introspection cache feature is explicitly enabled in the application configuration - this is not on by default; (3) the attacker possesses a valid, unexpired bearer token issued by at least one of the configured OIDC providers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) overstates exploitability on two metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a version of Enterprise Build of Quarkus beyond the affected ranges (above 3.27.5 in the 3.27.x train or above 3.33.3 in the 3.33.x train) per the IBM advisory at https://www.ibm.com/support/pages/node/7286498; exact fixed patch versions are not enumerated in the available input and should be confirmed directly with IBM/Red Hat. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today