This vulnerability arises from incorrect behavior order in Quarkus HTTP security, specifically a mismatch in how paths are normalized between the security matcher and HTTP request dispatchers. An unauthenticated attacker can exploit this discrepancy to bypass path-based access control rules, gaining unauthorized access to protected endpoints. The issue is classified under CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization). Red Hat acknowledges the flaw but currently does not offer an official fix or mitigation that meets their standards for ease of use, applicability, and stability.

The vulnerability allows unauthenticated attackers to bypass authorization controls and access protected endpoints in applications using Quarkus HTTP security. This can lead to unauthorized disclosure of sensitive information. The CVSS v3.1 score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Currently, no official fix or mitigation is available that meets Red Hat Product Security criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates. Until a suitable mitigation or patch is released, caution is advised when deploying affected Quarkus HTTP security configurations.