CyberRota Analysis
AI-GeneratedQuarkus applications with multiple endpoints secured by different OIDC provider tenants are vulnerable, allowing a valid token from one provider to access resources secured by another provider when a token introspection cache is enabled. This misconfiguration can lead to unauthorized access across different secured endpoints, potentially compromising sensitive data. Organizations utilizing Quarkus with multiple OIDC providers should prioritize addressing this vulnerability to ensure proper access controls are enforced.
Original NVD Description
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.