  The Isogeny to Endomorphism Ring Problem (IsERP) asks to compute the
endomorphism ring of the codomain of an isogeny between supersingular curves in
characteristic $p$ given only a representation for this isogeny, i.e. some data
and an algorithm to evaluate this isogeny on any torsion point. This problem
plays a central role in isogeny-based cryptography; it underlies the security
of pSIDH protocol (ASIACRYPT 2022) and it is at the heart of the recent attacks
that broke the SIDH key exchange. Prior to this work, no efficient algorithm
was known to solve IsERP for a generic isogeny degree, the hardest case
seemingly when the degree is prime.
  In this paper, we introduce a new quantum polynomial-time algorithm to solve
IsERP for isogenies whose degrees are odd and have $O(\log\log p)$ many prime
factors. As main technical tools, our algorithm uses a quantum algorithm for
computing hidden Borel subgroups, a group action on supersingular isogenies
from EUROCRYPT 2021, various algorithms for the Deuring correspondence and a
new algorithm to lift arbitrary quaternion order elements modulo an odd integer
$N$ with $O(\log\log p)$ many prime factors to powersmooth elements.
  As a main consequence for cryptography, we obtain a quantum polynomial-time
key recovery attack on pSIDH. The technical tools we use may also be of
independent interest.
