THREAT OPS › Threat News › [GHSA] GHSA-qcxp-gm7m-4j5v (high) — Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
[GHSA] GHSA-qcxp-gm7m-4j5v (high) — Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
GHSA-qcxp-gm7m-4j5v Severity: high CVE: CVE-2026-50559
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is
MITRE ATT&CK techniques
- VulnerabilitiesT1588.006
Indicators of compromise
- CVE-2026-50559cve
- CVE-2026-39852cve
- http://target/api/admin%3Bbypass=true/dataurl
- http://target/api/secret%3b/dataurl
- http://target/static-secret%2Fhtmlurl
- http://target/static-secret%5Chtmlurl
Original source: https://github.com/advisories/GHSA-qcxp-gm7m-4j5v