Apache Camel’s OAuth component did not bind a state value to the session when generating the authorization request, and the callback did not validate the state. This omission enables a malicious site to create an authorization flow that the victim’s browser will complete, allowing the attacker to redeem the code and log the victim into the attacker’s account. The same flaw also permits tampering with the post‑authentication redirect target, exposing an open redirect from a trusted origin. The vulnerability is therefore a classic cross‑site request forgery that delivers credential compromise and potential data leakage.

This issue affects Apache Camel versions 4.11.0 through 4.18.4, 4.19.0 through 4.22.0, and 4.23.0 is the first patched release. Users on the 4.18.x LTS stream should upgrade to 4.18.5, while those on the 4.22.x LTS stream should upgrade to 4.22.1. The Apache Software Foundation’s Apache Camel product is the sole affected vendor in the supplied data.

The CVSS base score of 6.1 indicates a moderate severity. The EPSS score is not provided, but the vulnerability is reachable in any web browser that initiates an OAuth flow, with no special environment or privileged access required. Because the flaw is a CSRF weakness, attackers can trigger the exploit by simply embedding a malicious request in a trusted site, and the attack does not depend on the identity provider’s configuration. The CVE is not listed in CISA’s KEV catalog, so no known public exploits are confirmed, but the nature of the flaw suggests a high likelihood of abuse if an attacker discovers this path in a widely deployed Camel instance.