CVE-2026-94386

Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on behalf of the components that...

CVE-2026-94386

The Apache Camel OAuth component (versions 4.19.0 to before 4.22.2) is vulnerable to a Use of Cache Containing Sensitive Information (CWE-524) flaw. The OAuthClientCredentialsTokenResolver utilizes a static, JVM-global cache for OAuth 2.0 bearer tokens. Because the cache is keyed only by the toke...

EUVD-2026-109957

Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on behalf of the components that...

CVE-2026-94386 Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on behalf of the components that...

CVE-2026-80312

Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to...

CVE-2026-84178

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

EUVD-2026-104209

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-2026-84178 Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-2026-80312

The camel-oauth component in Apache Camel contains an Improper Authentication vulnerability (CWE-287) where route-guard processors (e.g., OAuthBearerTokenProcessor) fail to stop the exchange when authentication cannot be completed. Instead of terminating the route, the processors fall through, al...

EUVD-2026-104215

Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to...

CVE-2026-80312 Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors

Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to...

CVE-2026-80312 Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors

Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to...

CVE-2026-80312: Improper Authentication

Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to...

PT-2026-117342

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-2026-84178: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

PT-2026-117338

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.11.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description An improper authentication issue exists in the Apache Camel OAuth component. The camel-oauth processors designed to guard routes fail to stop t...

N8n MCP OAuth XSS

The vulnerability of the MCP OAuth component of the automation platform for N8n processes is related to the lack of protective measures taken for the structure of the web page when processing the clientname parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site...