IncloakSecurityHelper.parseAndVerifyAccessToken constructs a TokenVerifier that applies only subject and issuer checks. It omits the IS_ACTIVE check that validates the token’s exp and nbf claims, so an access token that is expired or not yet valid is treated as authentic. This flaw allows a client to present a stale or premature token and obtain authentication, effectively bypassing the component’s security controls. The weakness reflects a failure to enforce the token’s validity window (CWE‑613).

The vulnerability impacts Apache Camel Camel‑Keycloak component versions 4.18.0 through 4.18.2.19.0 through 4.20.x. The cause is the absence of the default TokenVerifier.withDefaultChecks() invocation, resulting in missing expiration validation. Users should upgrade to Camel 4.21.0; for those remaining on the 4.18.x branch, 4.18.3 is the minimum safe version.

Based on the description, the 9.8 indicates critical severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers who can supply or manipulate an access token can bypass authentication controls over the network; the likely attack vector is remote via HTTP requests to Camel endpoints that rely on the Keycloak helper. Until a patch is applied, the risk becomes higher if token lifetimes are long or upstream gateways do not perform their own expiration checks.