The quarkiverse quarkus-openapi-generator extension for Quarkus had a vulnerability where its generated authentication filter matched OpenAPI path templates too broadly when deciding whether to attach credentials. This caused security schemes configured for one operation to be incorrectly applied to other operations with the same HTTP method but only partially matching paths. As a result, sensitive authentication credentials such as bearer tokens, API keys, or basic credentials could be sent to unintended endpoints. The vulnerability affects versions prior to 2.11.1-lts, 2.16.0-lts, and 2.17.0 and has been addressed in these versions.

Sensitive authentication credentials may be exposed to unintended endpoints due to overly broad matching of OpenAPI path templates by the authentication filter. This could lead to unauthorized actors receiving bearer tokens, API keys, or basic credentials not intended for them. The impact is limited to the exposure of sensitive information and does not include privilege escalation or code execution. No known exploits have been reported in the wild.

Upgrade to quarkus-openapi-generator versions 2.11.1-lts, 2.16.0-lts, or 2.17.0 or later, where this issue has been patched. Patch status is confirmed by the vendor's versioning information. No other mitigation steps are indicated.