The flaw is an improper input validation vulnerability in the Apache Camel Atmosphere WebSocket component that allows an attacker to supply specially crafted WebSocket dispatch headers such as websocket.connectionKey.list through an HTTP request that is bridged to a WebSocket producer. These headers are not filtered by Camel’s HTTP binding because they fall outside the Camel namespace, so the producer accepts them and uses them to determine which connected peers receive a message. As a result the sender can suppress an intended notification or redirect it to an arbitrary client whose connection key the attacker knows, compromising the confidentiality, integrity, or availability of real‑time communications. The weakness is a classic input validation error (CWE‑20).

Affected releases include all Apache Camel versions from 4.0.0 up to (but not including) 4.14.9, from 4.15.0 up to (but not including) 4.18.4, and from 4.19.0 up to (but not including) 4.22.0. The issue resides in the camel‑atmosphere‑websocket component used to bridge HTTP consumers to WebSocket producers.

The CVSS score is 9.8 and the EPSS score is less than 1%, indicating a high severity but a very low probability of exploitation. However, the vulnerability is exploitable via a straightforward HTTP request to a trusted route that forwards to the WebSocket producer, and authentication alone does not mitigate the issue. The lack of a KEV listing does not reduce the potential impact; the ability to hijack message delivery in real‑time streams makes this a high‑importance security concern.