The teenager, with North Macedonian roots, is considered the main suspect, working closely with a 17-year-old Austrian, general director for public security Frankz Ruf told ORF radio.
The pair are are part of a small group police are looking into, said Ruf, adding that the 19-year-old had pledged allegiance to the radical Islamic State group.
"We are of course investigating their wider surroundings," said Ruf, adding that the threat was minimized with the arrests.
Swift's three concerts in Vienna, expected to draw 195,000 people, were cancelled late on Wednesday after the government flagged a planned attack.
Police had detained three people suspected of plotting attacks on concerts.
Searches of the main suspect's house in the town of Ternitz near the Hungarian border showed "concrete preparatory actions," said Ruf, with chemical substances and technical devices seized.
The Kurier newspaper, citing sources familiar with the situation, reported that the suspect had stolen the chemicals from his workplace and had built a bomb.
The newspaper reported that the 19-year-old had planned to drive a car into the crowd expected to gather outside the stadium, and had also considered using machetes and knives.
Austria's interior ministry and intelligence service were not immediately available for comment on the report's details.
The shows were to be part of the record-breaking Eras Tour by the American singer-songwriter which started on March 17, 2023, in Glendale, Arizona and is set to conclude on December 8, 2024, in Vancouver, Canada.
Swift has not yet commented on the cancellations on her official Instagram account which has 283 million followers.
The 34-year-old has been taking Europe by storm, prompting some pundits to envisage an economic windfall as fans flock to dozens of sold-out shows from Dublin to Vienna and beyond.
After Vienna, Swift is set to sing in London where six concerts are scheduled at Wembley Stadium, starting on August 15.
