Vulnerability · Published Sep 8, 2026 · Assigned by ibm

CVE-2026-19625IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Medium 5.3

In plain English

A medium-severity improper access control in Enterprise Build of Quarkus from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 75.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

Affected products (as reported)

Vendor	Product	Versions
IBM	Enterprise Build of Quarkus	3.27.1 – through 3.27.53.33.1 – through 3.33.3

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://www.ibm.com/support/pages/node/7286498 vendor-advisory, patch