CVE-2026-85317

The Apache Camel HTTP component is vulnerable to an OAuth2 Token Confusion issue due to an under-keyed JVM-global token cache. Specifically, the cache key omits the requested scope , resource indicator , and token endpoint , causing multiple distinct endpoints to share the same cache entry. This ...

CVE-2026-85317 Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...