{}

{}

{}

{"bugzilla": {"description": "quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache", "id": "2517693", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517693"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-524", "details": ["A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass."], "name": "CVE-2026-19625", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Affected", "package_name": "exploit-intelligence-tech-preview/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "quarkus-oidc", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "quarkus-oidc", "product_name": "Red Hat build of Quarkus"}], "public_date": "2026-08-31T11:55:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19625\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19625"], "statement": "Important: This flaw in Quarkus OIDC allows for cross-tenant authentication bypass due to a shared token-introspection cache. In multi-tenant deployments of Red Hat products utilizing Quarkus OIDC, an attacker could potentially gain unauthorized access to other tenants' resources by exploiting this shared cache mechanism.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "product": "oidc", "vendor": "quarkus"}], "created": "2026-09-01T13:45:05.283730+00:00", "updated": "2026-09-02T22:09:52.842385+00:00", "vendors": ["quarkus", "quarkus$PRODUCT$oidc"]}