A flaw in Quarkus OIDC allows a remote attacker to use a shared token‑introspection cache to bypass authentication across tenant boundaries. By manipulating or reading cache entries, an attacker can gain unauthorized access to resources or data that belong to another tenant. The weakness falls under CWE‑524, indicating improper sanitization of token introspection data.

The vulnerability affects any deployment of Quarkus OIDC that uses a shared token‑introspection cache. No specific product versions are listed, so any environment employing this feature is potentially vulnerable until a vendor fix is released.

The CVSS score of 8.7 classifies this issue as high severity. The EPSS score is not available, but the lack of a CISA KEV listing suggests that known exploits are not yet widely documented. The most likely attack vector is a remote attacker submitting crafted requests to the introspection endpoint, taking advantage of the shared cache to impersonate other tenants. Prompt remediation is advised to prevent cross‑tenant credential theft or data exfiltration.