quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
Date: 2026-05
Affected: maven/io.quarkiverse.openapi.generator:quarkus-openapi-generator, maven/io.quarkiverse.openapi.generator:quarkus-openapi-generator
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-42333
CWE: CWE-200

### Summary The generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. ### Details The runtime authentication layer selects credentials by comparing the outgoing request path and method against the set of protected OpenAPI operations. Path-template matching treats `{param}` placeholders as `.*`, which incorrectly allows a single path parameter to consume `/`. As a result, a protected path such as `/repos/{ref}` also matches `/repos/foo/bar`, even though `/repos/{owner}/{repo}` is a different operation. When a client invokes the unprotected operation, the authentication filter still concludes that the protected operation matched and attaches its credentials. This affects authentication providers that rely on the shared path-matching logic, including bearer, OAuth, API-key, and basic authentication. The issue is reachable through normal generated-client usage and does not require modifying generated code. ### PoC ```bash mkdir -p /tmp/qoag-poc/src/main/java/org/acme mkdir -p /tmp/qoag-poc/src/main/resources mkdir -p /tmp/qoag-poc/src/main/openapi cat > /tmp/qoag-poc/pom.xml <<'EOF' <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="


Mitigations:

Architectural layers (MAESTRO):