Improper authentication arises when Camel's HTTP Main component accepts JWTs that are correctly signed and not expired but lacks the validation of the issuer (iss) and audience (aud) claims. An attacker who obtains or creates a token signed by any key in the configured keystore can therefore impersonate any authenticated user, regardless of who issued the token or for what audience it was intended. This flaw permits unauthorized access to protected endpoints, potentially exposing sensitive data or allowing further lateral movement within the application.

Apache Camel versions from 4.8.0 up to and including 4.21.x are affected because the platform does not enforce issuer or audience checks when JWT authentication is configured with a keystore. This applies to both the camel‑main embedded HTTP server component and the management server. Versions 4.14.x and 4.18.x can also be impacted unless they are upgraded to 4.14.9 or 4.18.4, where the new jwtIssuer and jwtAudience options exist but must be explicitly set to trigger validation. The highest‑grade patch that closes the issue is the 4.22.0 release, which blocks startup when no issuer or audience is supplied unless the optional jwtAllowMissingIssuerAndAudience flag is set.

The CVSS score of 7.5 indicates a high risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is categorized as an improper authentication flaw (CWE‑287), meaning that any attacker who can supply a JWT is able to bypass authentication entirely. Because the flaw accepts any unexpired token signed by a trusted key, it can be exploited remotely through any endpoint that requires JWT authentication. Attackers need only a signed token, which can be forged if they have access to a trusted key in the keystore, or obtained from a shared identity provider. With this capability, an attacker can gain unauthorized access to sensitive resources or compromise the integrity of requests. The lack of a denial‑of‑service impact reduces the overall risk, but the potential for full credential bypass remains high, so mitigations should be applied as soon as possible.