Description
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Enterprise Build of Quarkus | 3.27.1 – ≤ 3.27.5, 3.33.1 – ≤ 3.33.3 | — |
References
- https://www.ibm.com/support/pages/node/7286498 vendor-advisory patch