Apache Camel’s Shiro component can bypass authentication when a security subject is already bound to the thread that handles a Camel exchange. If the same principal is present on the thread from an earlier validated request, the component incorrectly skips credential verification for a subsequent request that supplies no valid credentials. This flaw, identified as CWE-287, enables an attacker to gain unauthorized access by crafting a request that references a principal already authenticated on the reused thread, without needing to know the user’s password.

The vulnerability impacts all Apache Camel releases from 4.0.0 up to but not including 4.18.5 and from 4.19.0 up to but not including 4.22.1. The affected system is the Apache Camel framework’s Shiro processor; thread reuse across exchanges creates the risk window.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available, suggesting no current exploitation data. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only that the attacker send a request naming a principal that is currently authenticated on the thread, and that the application’s thread pool reuses the same thread across exchanges. No privileged credentials are needed, making the attack path feasible via network traffic to the Camel service. Overall risk is moderate, with a clear path for unauthorized access if not mitigated.