Description
Improper Authentication vulnerability in Apache Camel OAuth component.



This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.
Published: 2026-10-19
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Authentication Bypass leading to unauthorized access
Action: Immediate Patch
AI Analysis

Impact

The flaw lies in the OAuth processors that guard Camel routes. When authentication cannot be established, the processors fail to halt the message exchange; instead the exchange passes to the next processors as if the request were authenticated. This fail‑open behavior allows an unauthenticated caller to reach any protected endpoint, giving direct access to resources that should be behind OAuth. The weakness is formally classified as CWE‑287, Improper Authentication.

Affected Systems

The vulnerability affects Apache Camel in the following releases: from version 4.11.0 up to (but excluding) 4.18.5, and from 4.19.0 up to (but excluding) 4.22.1. Any deployments using these ranges of Apache Camel, regardless of platform or hosting environment, are at risk.

Risk and Exploitability

The CVSS score is 8.2, indicating high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the problem can be triggered simply by sending a normal HTTP request to a Camel route that requires OAuth, with no special configuration required. Because the flaw permits unauthorized access to protected endpoints, the impact on confidentiality, integrity, and availability can be serious for all affected installations.

Generated by OpenCVE AI on October 19, 2026 at 11:40 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route.

Vendor Workaround

For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.

OpenCVE Recommended Actions

  • Upgrade to Apache Camel 4.23.0; for 4.18.x LTS releases upgrade to 4.18.5 and for 4.22.x LTS releases upgrade to 4.22.1.
  • If an upgrade is not immediately possible, add an explicit authorization check directly after the OAuth processor in each route and configure the route to terminate the exchange on authentication failure.
  • Audit Camel routes that use OAuth processors to confirm that downstream processors do not override the authentication check and that a failed authentication no longer leads to protected endpoints.

Generated by OpenCVE AI on October 19, 2026 at 11:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Camel
Apache camel
Vendors & Products Apache
Apache apache Camel
Apache camel

Mon, 19 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.
Title Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Apache Apache Camel Camel
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T10:27:34.015Z

Reserved: 2026-08-26T08:32:46.247Z

Link: CVE-2026-80312

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:21.073

Modified: 2026-10-19T11:17:21.073

Link: CVE-2026-80312

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:30:13Z

Weaknesses