The vulnerability arises in scenarios where a Quarkus application has multiple endpoints each secured by different OpenID Connect (OIDC) provider tenants, for example, "/oidc-provider1" secured by OIDC Provider 1 and "/oidc-provider2" secured by OIDC Provider 2. When the optional token introspection cache is enabled, a valid token issued by OIDC Provider 1, which should only grant access to "/oidc-provider1", can also be used to access "/oidc-provider2" secured by OIDC Provider 2. This represents a failure in enforcing proper access control between different OIDC tenant endpoints, categorized under CWE-284 (Improper Access Control).

An attacker with a valid token from one OIDC provider tenant can gain unauthorized access to endpoints secured by a different OIDC provider tenant within the same Quarkus application. This could lead to unauthorized information disclosure or access to resources intended to be isolated per OIDC tenant. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported.

Patch status is not yet confirmed — no official fix or remediation guidance has been provided by IBM for this vulnerability. Users should monitor IBM's advisories for updates. In the meantime, consider disabling the optional token introspection cache if feasible or segregating OIDC provider tenants to prevent token reuse across endpoints until a fix is available.