CVE-2026-19625: Quarkus OIDC Authentication Bypass Vulnerability

CVE-2026-19625 Overview

CVE-2026-19625 is an access control weakness ([CWE-284]) affecting Quarkus applications that use multiple OpenID Connect (OIDC) provider tenants with the optional token introspection cache enabled. When a Quarkus application secures separate endpoints with distinct OIDC providers, a valid token issued by one provider can be accepted at endpoints protected by a different provider. The cached introspection result is not scoped to the issuing tenant, allowing cross-tenant authentication reuse.

Critical Impact
An attacker with a valid token for one OIDC-protected endpoint can reuse it to access endpoints intended to be protected by a separate OIDC provider, breaking tenant isolation and enabling unauthorized read access.

Affected Products

Quarkus framework applications using the OIDC extension
Deployments configured with multiple OIDC provider tenants
Configurations with the optional token introspection cache enabled

Discovery Timeline

2026-09-08 - CVE-2026-19625 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-19625

Vulnerability Analysis

Quarkus supports multi-tenant OIDC configurations where individual HTTP endpoints are bound to distinct OIDC provider tenants. For example, /oidc-provider1 may be secured by OIDC Provider 1 while /oidc-provider2 is secured by OIDC Provider 2. To reduce network calls to identity providers, Quarkus offers an optional token introspection cache.

When the introspection cache is enabled, cache entries are keyed in a way that does not sufficiently bind a cached introspection result to the specific tenant that produced it. A token issued by Provider 1, once introspected and cached, is treated as valid by the request path secured by Provider 2. Tenant isolation between endpoints is therefore not enforced at the authorization layer.

The attack proceeds over the network without authentication or user interaction. The scope is limited to confidentiality impact on the second tenant's protected resources; integrity and availability are not directly affected.

Root Cause

The root cause is improper access control ([CWE-284]) in the token introspection cache lookup. The cache treats a successfully introspected token as globally valid across tenants rather than validating that the token's issuer matches the tenant assigned to the incoming request path.

Attack Vector

An attacker obtains a legitimate access token from OIDC Provider 1 through normal authentication against /oidc-provider1. The attacker then sends the same bearer token to /oidc-provider2. Because a prior introspection result is cached and reused without a tenant-scoped check, the request is authorized against Provider 2's endpoint despite the token having been issued by Provider 1.

See the IBM Support Article for vendor-specific product exposure details.

Detection Methods for CVE-2026-19625

Indicators of Compromise

Successful requests to a tenant-protected endpoint carrying access tokens whose iss (issuer) claim does not match the tenant configured for that endpoint.
Access log entries showing the same bearer token accepted across endpoints bound to different OIDC providers.
Introspection cache hits associated with token issuers that differ from the request's target tenant.

Detection Strategies

Instrument the Quarkus OIDC filter to log the token's iss claim alongside the matched tenant identifier for every authorized request.
Correlate authorization decisions with expected issuer-to-tenant mappings and alert on mismatches.
Review OIDC provider audit logs for tokens that were issued for one audience but observed against endpoints belonging to another.

Monitoring Recommendations

Continuously monitor HTTP access logs on multi-tenant endpoints for tokens whose aud or iss claims do not align with the endpoint's tenant configuration.
Baseline introspection cache hit ratios per tenant and alert on cross-tenant reuse patterns.
Forward Quarkus OIDC and access telemetry to a centralized analytics platform for long-window correlation.

How to Mitigate CVE-2026-19625

Immediate Actions Required

Disable the optional token introspection cache in Quarkus OIDC configuration until a patched version is deployed.
Inventory all Quarkus services using multi-tenant OIDC and confirm which have quarkus.oidc.token-cache enabled.
Rotate any tokens that may have been improperly accepted by a mismatched tenant during the exposure window.

Patch Information

Refer to the IBM Support Article for the fixed Quarkus versions and upgrade guidance. Upgrade to a Quarkus release that scopes introspection cache entries to the resolving OIDC tenant.

Workarounds

Set the introspection cache size to zero to disable caching for multi-tenant deployments.
Deploy separate Quarkus applications per OIDC tenant so no single process holds a shared introspection cache across providers.
Add a request-time validator that compares the token's iss claim against the resolved tenant's expected issuer and rejects mismatches.

bash

# Configuration example: disable the OIDC token introspection cache
quarkus.oidc.token-cache.max-size=0
quarkus.oidc.token-cache.time-to-live=0S