CyberRota Analysis
AI-GeneratedA vulnerability in Quarkus HTTP security allows unauthenticated attackers to exploit inconsistencies in path normalization between the security matcher and HTTP request dispatchers. This can lead to authorization bypass, enabling access to protected endpoints and potentially exposing sensitive information. Organizations using Quarkus should prioritize addressing this issue to safeguard their applications against unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.