CVE-2026-87743
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Sep 18, 2026
CISA due date
—
The record
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-551
- CVE-2026-16102 A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an… CWE-551
- CVE-2026-15573 A flaw was found in Keycloak's Authorization Services. CWE-551
- CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN)… CWE-551
- CVE-2026-57920 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass… CWE-551
- CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications. CWE-551
- CVE-2026-44574 Next.js is a React framework for building full-stack web applications. CWE-551
- CVE-2026-44575 Next.js is a React framework for building full-stack web applications. CWE-551