io.hawt.examples:hawtio-example-quarkus-keycloak (5.3.0), io.quarkus:quarkus-keycloak-authorization (>=3.39.0, <=3.39.1) +15 more potentially affected by CVE-2026-19625 via io.quarkus:quarkus-oidc (>=3.39.0, <=3.39.1)

io.quarkus:quarkus-oidc MAVEN version =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.5.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.0 and more Source cves: CVE-2026-19625 Source advisory: MEND:CVE-2026-19625...

quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache

A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass...

quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache

A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass...

CVE-2026-19625

A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass...

ai.wanaku:wanaku-router-backend (>=0.0.8, <=0.0.9), io.apicurio:apicurio-registry-app (>=3.1.5, <=3.2.6) +97 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-oidc (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-oidc MAVEN version =3.21.0.cr1, =0.0.8, =3.1.5, =3.1.5, =3.1.5, =3.1.5, =3.1.5, =4.6.0, =0.18.0, =0.18.0, =0.3.0, =0.3.0, =0.3.0, =3.1.0, =3.21.0.cr1, =3.21.0.cr1, =3.27.4 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375078...

ai.wanaku:wanaku-router-backend (>=0.1.1, <=0.2.0), de.christophbrill.appframework:appframework (>=4.0.5, <=4.2.0) +45 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-oidc (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-oidc MAVEN version =3.28.0.cr1, =0.1.1, =4.0.5, =4.7.0, =0.19.0, =1.13.0, =1.13.0, =1.13.0, =0.4.0, =0.4.0, =0.4.0, =0.5.0 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375078...

Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes in the request path. An attacker can gain unauthorized...

ai.wanaku:wanaku-router-backend (>=0.0.8, <=0.0.9), io.apicurio:apicurio-registry-app (>=3.1.5, <=3.2.5) +97 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-oidc (>=3.21.0, <=3.27.3)

io.quarkus:quarkus-oidc MAVEN version =3.21.0, =0.0.8, =3.1.5, =3.1.5, =3.1.5, =3.1.5, =3.1.5, =4.6.0, =0.18.0, =0.18.0, =0.3.0, =0.3.0, =0.3.0, =3.1.0, =3.21.0, =3.21.0, =3.27.3 and more Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420252...

io.quarkus:quarkus-keycloak-authorization (>=3.35.0.cr1, <=3.35.0), io.quarkus:quarkus-keycloak-authorization-deployment (>=3.35.0.cr1, <=3.35.0) +7 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-oidc (>=3.35.0.cr1, <=3.35.0)

io.quarkus:quarkus-oidc MAVEN version =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420252...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.5), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.5) +153 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-oidc (>=3.0.0.alpha1, <=3.20.6)

io.quarkus:quarkus-oidc MAVEN version =3.0.0.alpha1, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.13 and more Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420252...

io.quarkus:quarkus-keycloak-authorization (0.28.1), io.quarkus:quarkus-keycloak-authorization-deployment (0.28.1) +21 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (0.28.1)

io.quarkus:quarkus-vertx MAVEN version 0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-keycloak-authorization 0.28.1 - io.quarkus:quarkus-keycloak-authorization-deployment 0.28.1...

com.github.mcollovati:quarkus-hilla (>=1.0.0, <=1.0.1), com.github.mcollovati:quarkus-hilla-deployment (>=1.0.0, <=1.0.1) +58 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (2.16.10.final)

io.quarkus:quarkus-resteasy-reactive-common MAVEN version 2.16.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common and may be impacted: - com.github.mcollovati:quarkus-hilla =1.0.0, =1.0.0, =1.0.1 -...

io.automatiko.quarkus:automatiko-operator-deployment (0.10.0), io.automatiko.quarkus:automatiko-service-deployment (0.10.0) +12 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.4.1.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.6.0.cr1), io.quarkus:quarkus-oidc-client-reactive-filter-deployment (2.6.0.cr1) +12 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.6.0.cr1)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-jaxrs-client-reactive (2.7.3.final), io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.7.3.final) +43 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (2.7.3.final)

io.quarkus:quarkus-resteasy-reactive-common MAVEN version 2.7.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common and may be impacted: - io.quarkus:quarkus-jaxrs-client-reactive 2.7.3.final -...

io.quarkiverse.renarde:quarkus-renarde (1.0.1), io.quarkiverse.renarde:quarkus-renarde-backoffice (1.0.1) +54 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (2.9.0.cr1)

io.quarkus:quarkus-resteasy-reactive-common MAVEN version 2.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common and may be impacted: - io.quarkiverse.renarde:quarkus-renarde 1.0.1 -...

io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.0.0.cr1), io.quarkus:quarkus-oidc-client-reactive-filter-deployment (2.0.0.cr1) +9 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.0.0.cr1)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

io.quarkus:quarkus-jaxrs-client-reactive-deployment (2.0.1.final), io.quarkus:quarkus-oidc-client-reactive-filter-deployment (2.0.1.final) +9 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (2.0.1.final)

io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy-reactive-common-deployment and may be impacted: -...

quarkus-oidc: ID and access tokens leak via the authorization code flow

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...

Insecure Session Cookie Handling

quarkus-oidc is vulnerable to Insecure OIDC Session Cookie Handling. The vulnerability exists because the library does not properly encrypt the OIDC session cookie value by default which leads to the leakage of both ID and access tokens in the authorization code flow when an insecure HTTP protoco...