A flaw in the hawtio-operator creates a cluster‑scoped OAuthClient that approves grant requests automatically and contains no secret, making the client effectively public. A tenant that controls the Hawtio resource can register an arbitrary hostname as a valid redirect target; when a cluster user follows the crafted OAuth URL the operator's auto‑approval supplies an OpenShift access token without prompting for consent, allowing the attacker to obtain credentials to act as that user. This flaw is a classic OAuth token theft scenario and is classified under CWE‑1390.

Red Hat build of Apache Camel - HawtIO 4 (version 4) in Red Hat clusters. Any installation of the hawtio‑operator that deploys Hawtio in cluster mode is susceptible; a malicious tenant with access to create or modify the Hawtio Custom Resource can trigger the vulnerability.

The vulnerability carries a CVSS score of 8.7, indicating high severity, but its EPSS score is not reported, making the current exploitation probability uncertain. It is not yet listed in the CISA KEV catalog. The attack requires a tenant that can submit the Hawtio specification and register a custom hostname, after which the operator will automatically grant OAuth tokens for any user who visits that URL. The weaknesses are tractable because the operator itself creates the OAuthClient; a workaround is to patch the OAuthClient to set grantMethod to 'prompt' and to supply a client secret, which forces user consent and prevents theft. Until a vendor patch is applied, the risk remains significant for multi‑tenant OpenShift deployments using hawtio‑operator.