EUVD-2026-82862
GHSA-pw2v-hfg7-72m6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote URL crafting (AV:N/AC:L/PR:N/UI:N) bypasses path-based authorization to read protected data; confidentiality-only (C:H), no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
AnalysisAI
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an affected application to rely on Quarkus HTTP security path-based authorization (a security matcher / path-pattern policy) to protect sensitive endpoints; the attacker sends a specially encoded URL that the security matcher normalizes as a public path while the request dispatcher normalizes it to the protected endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) describes a genuinely attractive flaw: network-reachable, low-complexity, unauthenticated authorization bypass yielding high confidentiality impact with no integrity or availability effect - consistent with reading protected data via a security-matcher/dispatcher path-normalization discrepancy (CWE-551). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed version is identified in the provided data; track Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-87743 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2530523 for the vendor patch and apply it as soon as a Quarkus or Red Hat Build of Quarkus update is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Quarkus applications that use path-based security policies for confidential endpoints and review their configurations; immediately enforce handler-level role or annotation-based authorization checks as a primary control, and ensure that reverse proxies or API gateways normalize URL paths before forwarding to Quarkus. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today