The KeycloakSecurityPolicy in Apache Camel Keycloak performs a token presence check but skips cryptographic verification unless a requiredRoles or requiredPermissions setting is supplied. Because the default configuration leaves these lists empty, any non‑null Authorization: Bearer header value – even an unsigned or forged JWT – is accepted, permitting an attacker to bypass authentication and reach a protected route. This flaw constitutes an authentication bypass and can lead to code execution if the route forwards to a producer that performs server‑side work.

The vulnerability affects the Apache Camel Keycloak component in Apache Camel versions 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x. Versions 4.18.3 and 4.21.0 and later contain the fix; the patch also applies to the 4.18.x release stream.

The CVSS score of 9.8 indicates high severity, while the EPSS score of less than 1% signals a currently low exploitation likelihood. The flaw is exploitable remotely by sending a crafted HTTP request with any non‑null Authorization: Bearer token to a route guarded by the default policy. If the target performs privileged operations, an attacker can gain unauthenticated access or possibly execute code. Although no public exploitation has been reported and the issue is not listed in CISA KEV, its impact remains serious for exposed services.