CVE-2026-87743 — Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispat…
Published: 2026-09-18 · CVSS: 7.5 · CVSS 3.1
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7