What is CVE-2026-19625?

CVE-2026-19625 is a medium-severity vulnerability in IBM Enterprise Build Of Quarkus, classified under Improper Access Control. CVSS score: 5.3/10. Published 2026-09-08.

How severe is CVE-2026-19625?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in IBM Enterprise Build Of Quarkus

CVE-2026-19625

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Ibm Enterprise Build Of Quarkus

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-19625?: CVE-2026-19625 is a medium-severity vulnerability in IBM Enterprise Build Of Quarkus, classified under Improper Access Control. CVSS score: 5.3/10. Published 2026-09-08.
How severe is CVE-2026-19625?: Medium severity. CVSS v3 base score is 5.3 out of 10.