CVE-2026-95663

Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

View on CVE.org
Published Oct 26, 2026 CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
Insufficient Session Expiration vulnerability in Apache Camel Keycloak component.



This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2.



When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspection results are cached by default (introspectionCacheEnabled=true, introspectionCacheTtl=60 seconds), and both cache implementations shipped with the component, ConcurrentMapTokenCache and CaffeineTokenCache, expired an entry a fixed time after it was inserted, without bounding that lifetime by the exp claim that the cached response already carried. KeycloakSecurityProcessor in turn checked only the active flag of the result, on every path that uses introspection, and never compared exp with the current time. A response cached shortly before the token expired was therefore served to later requests carrying the same token for up to the configured time-to-live after the token's expiry, and those requests were admitted with the roles and permissions the expired token had carried, although RFC 7662, which defines token introspection, states that a response containing exp must not be cached beyond that time. The access token is supplied by the caller with each request, typically as a bearer token in the Authorization header, so a caller holding a token that was valid moments earlier could keep using it after it expired, for as long as the cached entry lived. The window is bounded by introspectionCacheTtl, which is 60 seconds by default and 300 to 600 seconds where the documentation's recommendation for internal services was followed, and it opens only for a token that the same Camel process introspected and cached while the token was still active. The issue grants nothing beyond what the token already carried: it allows no token forgery and no privilege escalation, and token introspection is not enabled by default, which is why the severity is assessed medium. The local JWT verification path, used when introspection is disabled, is not affected by this issue.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.16.x, 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy, so that every request is checked against the introspection endpoint, which reports an expired token as inactive, at the cost of one introspection call per request. Lowering introspectionCacheTtl only narrows the window and does not close it.

Analysis

AI-generated

Technical impact

When Apache Camel Keycloak security policy uses token introspection, the component caches the result and only checks the active flag, never the explicit expiration time, for up to the configured TTL. A token that is still active when cached can be accepted for up to minutes after its real exp has passed, allowing the bearer to continue using the same roles and permissions. This does not provide token forgery or privilege escalation, but it breaks the expected enforcement of token lifespan and weakens session validity controls.

Affected Systems

Apache Camel component versions from 4.16.0 through 4.18.4, from 4.19.0 through 4.22.1 are affected. The component lines 4.16.x‑4.18.x and 4.19.x‑4.21.x have reached end‑of‑life and will not receive a fix, so users must migrate to a supported release such as 4.23.0, or, for the 4.22.x and 4.18.x streams, upgrade to 4.22.2 or 4.18.5 respectively.

Risk and Exploitability

The CVSS score of 4.8 indicates medium severity. EPSS is not available, and the issue is not listed in CISA KEV, so the likelihood of widespread exploitation is currently unquantified. Attackers would need to possess a valid access token and be able to send authenticated requests; the vulnerability allows them to reuse that token after its expiration for a limited period bounded by the caching TTL. Because the window is small and the vulnerability does not provide escape from existing permissions, risk is moderate but non‑negligible for systems relying heavily on strict session expiration.

Remediation

Vendor Solution

Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. Both cache implementations now bound the lifetime of each entry by the shorter of introspectionCacheTtl and the time remaining until the token's exp, a result whose token has already expired is never served from the cache, and KeycloakSecurityProcessor now rejects a token whose exp lies in the past on every path that uses introspection, so expiry is enforced on the introspection path as it is on the local JWT verification path. The 4.16.x, 4.17.x and 4.19.x to 4.21.x releases streams reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.

Vendor Workaround

For deployments that cannot upgrade immediately, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy, so that every request is checked against the introspection endpoint, which reports an expired token as inactive, at the cost of one introspection call per request. Lowering introspectionCacheTtl only narrows the window and does not close it.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to 4.23.0 (or to 4.22.2 if on the 4.22.x stream, or to 4.18.5 if on the 4.18.x stream) to receive the fix that bounds cache entries by token expiration.
  • If an upgrade cannot be performed immediately, set introspectionCacheEnabled to false on the KeycloakSecurityPolicy so each request is validated directly against the introspection endpoint, which rejects expired tokens.
  • Optionally reduce introspectionCacheTtl to the smallest value compatible with performance requirements, though this merely shortens the window rather than fully closing it.

Generated by OpenCVE AI on October 26, 2026 at 10:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Apache
Apache apache Camel
Apache camel
Vendors & Products Apache
Apache apache Camel
Apache camel
Type Values Removed Values Added
Description Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspection results are cached by default (introspectionCacheEnabled=true, introspectionCacheTtl=60 seconds), and both cache implementations shipped with the component, ConcurrentMapTokenCache and CaffeineTokenCache, expired an entry a fixed time after it was inserted, without bounding that lifetime by the exp claim that the cached response already carried. KeycloakSecurityProcessor in turn checked only the active flag of the result, on every path that uses introspection, and never compared exp with the current time. A response cached shortly before the token expired was therefore served to later requests carrying the same token for up to the configured time-to-live after the token's expiry, and those requests were admitted with the roles and permissions the expired token had carried, although RFC 7662, which defines token introspection, states that a response containing exp must not be cached beyond that time. The access token is supplied by the caller with each request, typically as a bearer token in the Authorization header, so a caller holding a token that was valid moments earlier could keep using it after it expired, for as long as the cached entry lived. The window is bounded by introspectionCacheTtl, which is 60 seconds by default and 300 to 600 seconds where the documentation's recommendation for internal services was followed, and it opens only for a token that the same Camel process introspected and cached while the token was still active. The issue grants nothing beyond what the token already carried: it allows no token forgery and no privilege escalation, and token introspection is not enabled by default, which is why the severity is assessed medium. The local JWT verification path, used when introspection is disabled, is not affected by this issue. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.16.x, 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy, so that every request is checked against the introspection endpoint, which reports an expired token as inactive, at the cost of one introspection call per request. Lowering introspectionCacheTtl only narrows the window and does not close it.
Title Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
Weaknesses CWE-613
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}
Weaknesses
  • CWE-613

    Insufficient Session Expiration

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
Nov 2, 2026, 8:57 PM
Reserved
Sep 22, 2026, 12:58 PM

View source JSON

Updated
Nov 2, 2026, 8:57 PM

JSON

Status
Analyzed
Published
Oct 26, 2026, 9:16 AM
Modified
Nov 6, 2026, 4:19 PM

View source JSON

No data.

Updated
Oct 26, 2026, 10:45 AM

JSON