Executive brief
Quarkus is a Java application framework that many organizations use to build microservices. When a Quarkus application protects multiple endpoints with different OpenID Connect (OIDC) providers and enables token caching, an attacker with a valid token from one provider can incorrectly gain access to endpoints secured by a different provider. This breaks the intended isolation between authentication domains and could allow unauthorized access to protected resources.
Technical details
The vulnerability is an improper access control issue (CWE-284) in Quarkus's OIDC integration when token introspection caching is enabled. The root cause is that the token introspection cache fails to properly account for the OIDC provider tenant identity, allowing tokens from one provider to be accepted as valid for endpoints secured by another provider. An attacker with a valid token from OIDC Provider 1 can send it to an endpoint protected by OIDC Provider 2; the cached introspection result is incorrectly reused across provider boundaries. The attack requires network access to the application and no authentication or special privileges beyond holding a valid token from any configured provider. The fix is available in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1.
Affected products
- IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, 3.33.1 through 3.33.3
Timeline
- 2026-09-08: disclosed