Apache Camel’s HTTP component may re‑attach OAuth2 bearer tokens and basic or digest credentials to any host the remote server redirects to when followRedirects is enabled. The interceptor that injects the Authorization header runs on every redirect hop, and credentials are stored against a generic host scope. An attacker who can influence a server’s redirects can therefore capture the bearer token or credential credentials sent to the attacker‑controlled host, resulting in unauthorized access to protected resources.

Apache Camel products from the Apache Software Foundation are affected. Versions prior to 4.18.5 in the 4.18.x LTS line, prior to 4.22.1 in the 4.22.x LTS line, and all versions from 4.0.0 up to 4.18.4 are vulnerable.

The vulnerability is scored CVSS 7.5, indicating a high risk level. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or influence the redirect response; once a redirect is issued, credentials automatically leak to the attacker’s host. The attack surface is greatest in environments that enable automatic redirects without additional checks.