CVE-2026-50559: quarkus Improper Authentication

Vulnerability summary

CVE-2026-50559 is a high (CVSS 7.5) Improper Authentication vulnerability in quarkus. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-06-2026
   PublishedVulnerability first disclosed.
2. 13-08-2026
   Last modifiedVulnerability information updated.

Description

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.