Description
Improper Authentication vulnerability in Apache Camel Keycloak component.

This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.




The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim. When the claim was absent the check was skipped rather than treated as a failure, so a token that the configured issuer did not mint could be accepted provided the introspection endpoint answered without naming an issuer. Reaching this requires an introspection endpoint that omits iss and accepts tokens from more than one issuer, which is not the default Keycloak arrangement, hence the low severity; where that arrangement exists the consequence is that the deployment authenticates a caller it should have rejected.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. An absent iss claim is now treated as a validation failure rather than as a reason to skip the check. For deployments that cannot upgrade immediately, ensure the introspection endpoint returns the iss claim, and that it serves exactly one issuer.
Published: 2026-10-19
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Authentication Bypass
Action: Upgrade
AI Analysis

Impact

The vulnerability allows an attacker to use a token not issued by the configured issuer when the Keycloak introspection response does not include an "iss" claim. In that situation the Camel authentication processor skips issuer validation, accepting the token as valid. The flaw therefore permits authentication bypass for specific tokens that would otherwise be rejected, compromising confidentiality and integrity of the application’s security controls.

Affected Systems

Affected deliveries are Apache Camel from version 4.15.0 up to, but not including, 4.18.5, and from 4.19.0 up to, but not including, 4.22.1. Users on the 4.18.x LTS line should upgrade to 4.18.5, and those on the 4.22.x LTS line should upgrade to 4.22.1, with the latest available release being 4.23.0.

Risk and Exploitability

The CVSS score of 4.8 classifies the flaw as low impact under normal conditions; the EPSS score is not disclosed and the issue is not listed in the CISA KEV catalog. Exploitation requires a non‑default introspection endpoint that omits the "iss" claim and accepts tokens from multiple issuers, a configuration that is not common in stock Keycloak deployments. Consequently, the real‑world risk is limited, though the vulnerability can still be abused in environments with the described configuration.

Generated by OpenCVE AI on October 19, 2026 at 12:26 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. An absent iss claim is now treated as a validation failure rather than as a reason to skip the check.

Vendor Workaround

For deployments that cannot upgrade immediately, ensure the introspection endpoint returns the iss claim, and that it serves exactly one issuer.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to version 4.23.0, or for LTS streams upgrade to 4.18.5 or 4.22.1 as appropriate.
  • If an immediate upgrade is not feasible, modify the Keycloak introspection endpoint so that it includes the "iss" claim and guarantees that only a single issuer is served.
  • Review and enforce that all token introspection calls validate the issuer claim before authentication proceeds.

Generated by OpenCVE AI on October 19, 2026 at 12:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim. When the claim was absent the check was skipped rather than treated as a failure, so a token that the configured issuer did not mint could be accepted provided the introspection endpoint answered without naming an issuer. Reaching this requires an introspection endpoint that omits iss and accepts tokens from more than one issuer, which is not the default Keycloak arrangement, hence the low severity; where that arrangement exists the consequence is that the deployment authenticates a caller it should have rejected. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. An absent iss claim is now treated as a validation failure rather than as a reason to skip the check. For deployments that cannot upgrade immediately, ensure the introspection endpoint returns the iss claim, and that it serves exactly one issuer.
Title Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T14:35:58.104Z

Reserved: 2026-09-03T16:41:14.419Z

Link: CVE-2026-85301

cve-icon Vulnrichment

Updated: 2026-10-19T14:35:49.723Z

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:24.290

Modified: 2026-10-19T15:17:07.570

Link: CVE-2026-85301

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:30:14Z

Weaknesses