The vulnerability arises when a Quarkus application that secures multiple endpoints with distinct OIDC provider tenants does not isolate the token‑introspection cache. An attacker with a valid token issued by one tenant can exploit the shared cache to access an endpoint secured by another tenant, effectively bypassing authentication boundaries. This exposes resources belonging to other tenants and is classified as CWE‑284 (Improper Access Control) and CWE‑524 (Improper Validation or Sanitization).

The vulnerability affects IBM Enterprise Build of Quarkus versions 3.27.1, 3.27.5, 3.33.1, and 3.33.3, as identified by their CPEs. Deployments using a shared token‑introspection cache are potentially vulnerable until the vendor releases the fix. Any environment that relies on this feature without a tenant‑isolated cache configuration is at risk.

The CVSS score of 5.3 classifies this issue as moderate severity. EPSS score is not available, but the lack of a CISA KEV listing suggests that known exploits are not yet widely documented. The most likely attack vector is a remote attacker submitting crafted requests to the introspection endpoint, taking advantage of the shared cache to impersonate other tenants. Prompt remediation is advised to prevent cross‑tenant credential theft or data exfiltration.