The vulnerability originates from an overly broad path‑parameter matching algorithm used by Quarkus OpenAPI Generator when deciding whether to attach an authentication filter. As a result, credentials such as bearer tokens, API keys, or HTTP basic authentication are added to requests that target endpoints whose paths only partially resemble the configured protected path template. This behavior can expose credentials to endpoints that were not intended to receive them, potentially allowing an attacker to gather or misuse authentication information.

Organizations that use the quarkiverse:quarkus-openapi-generator extension to generate REST client or server code are affected. All versions of the extension prior to 2.11.1‑lts, 2.16.0‑lts, and 2.17.0 contain the flaw, while the patched releases address the issue.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity. While no exploit score is available and it is not listed in the CISA KEV catalog, the flaw could be leveraged by anyone who controls or reacts to the generated client or server stubs, such as during CI/CD pipelines or API documentation publishing. An attacker who forces a client to send authentication headers to unintended endpoints could obtain credentials or execute unauthorized actions on those endpoints.