The Apache Camel Keycloak component uses a helper that builds a TokenVerifier with only subject‑existence and issuer checks, intentionally or unintentionally omitting the default IS_ACTIVE check that validates the token’s expiration (exp) and not‑before (nbf) claims. As a result, an access token that is already expired or not yet valid is treated as authentic, allowing the bearer to authenticate without a fresh, valid token. This flaw permits unauthorized access to Camel routes that rely on the helper, effectively bypassing the intended session‑expiration enforcement of the tokens and violating the intended security guarantees.

Apache Camel 4.18.0 through 4.18.2 and 4.19.0 through 4.20.x are affected. The issue is present in the Camel Keycloak component of these versions; upgrading to 4.21.0 or, for the 4.18.x line, to 4.18.3, resolves the missing IS_ACTIVE validation.

The CVSS score of 9.8 classifies this as critical, while the EPSS score of less than 1 % indicates a low probability of exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can supply a valid yet expired or premature token can gain authentication over the network, bypassing Keycloak’s standard lifetime checks. The most likely attack vector is remote, via HTTP requests to Camel endpoints that use the Keycloak helper, and the risk increases if tokens have long lifetimes or upstream gateways do not perform their own expiration validation.