CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

CVE-2026-46455

CVE-2026-46455 — camel-keycloak Missing ISACTIVE Check Expired Tokens Accepted Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-keycloak 4.18.2 Cam...

CVE-2026-53913

CVE-2026-53913 — camel-keycloak Fail-Open Authentication Bypass Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CVE-2026-85301

CVE-2026-85301 — camel-keycloak: issuer validation bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-keycloak's KeycloakSecurityProcessor validated the issuer of an introspected token only when the introspection response actually carried aniss claim. When...

CVE-2026-95663

CVE-2026-95663 — camel-keycloak: a cached introspection result was served past the token's expiry Runnable proof-of-concept reproducer for the Apache Camel vulnerability where KeycloakSecurityPolicy with token introspection enabled useTokenIntrospection=true kept honouring an access token after i...

io.kaoto.forage:forage-security-keycloak (>=1.5.0, <=1.6.1), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.40.0) +3 more potentially affected by CVE-2026-95663 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.22.1)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.1 Source cves: CVE-2026-95663 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21816688...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the KeycloakSecurityProcessor in the camel-keycloak component. When token introspection and result caching are enabled, a caller can keep sending an access token that Camel introspected and cached whi...

io.kaoto.forage:forage-security-keycloak (>=1.5.0, <=1.6.1), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.40.0) +3 more potentially affected by CVE-2026-95663 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.22.1)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.1 Source cves: CVE-2026-95663 Source advisory: MEND:CVE-2026-95663...

Exploit for CVE-2026-85301

CVE-2026-85301 — camel-keycloak: issuer validation bypass Run...

io.kaoto.forage:forage-security-keycloak (>=1.5.0, <=1.6.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.39.0) +3 more potentially affected by CVE-2026-85301 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.22.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85301 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429428...

Missing Critical Step in Authentication

Overview Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the validateIssuerFromIntrospection function in the Keycloak security processor. An attacker can access routes protected by issuer validation using a token not minted by the configured issuer ...

io.kaoto.forage:forage-security-keycloak (>=1.5.0, <=1.6.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.39.0) +3 more potentially affected by CVE-2026-85301 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.22.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85301 Source advisory: MEND:CVE-2026-85301...

io.kaoto.forage:forage-security-keycloak (>=1.3, <=1.4.1), org.apache.camel.karaf:camel-keycloak (>=4.18.1, <=4.18.4) +4 more potentially affected by CVE-2026-85301 via org.apache.camel:camel-keycloak (>=4.18.0, <=4.18.4)

org.apache.camel:camel-keycloak MAVEN version =4.18.0, =1.3, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.4 Source cves: CVE-2026-85301 Source advisory: MEND:CVE-2026-85301...

CVE-2026-53913 — Updated!

CVE-2026-53913 — camel-keycloak Fail-Open Authentication Bypass Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

Exploit for Insufficient Session Expiration in Apache Camel

camel-keycloak Missing ISACTIVE Check — Expired Tokens Accept...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46455 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892117...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via KeycloakSecurityHelper.parseAndVerifyAccessToken in the camel-keycloak component. An attacker can authenticate with an expired or not-yet-valid access token by sending a signed token to code paths tha...

io.kaoto.forage:forage-security-keycloak (1.3), org.apache.camel.karaf:camel-keycloak (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.18.0, <=4.18.2)

org.apache.camel:camel-keycloak MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46455 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892117...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the KeycloakSecurityPolicy process. An attacker can gain unauthorized access to protected routes by supplying any non-null value in the Authorization: Bearer header, which is accepted without cryptographic...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-53913 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-53913 Source advisory: GHSA-QVC3-6Q9X-95PJ...