CVE-2026-95663

CVE-2026-95663 — camel-keycloak: a cached introspection result was served past the token's expiry Runnable proof-of-concept reproducer for the Apache Camel vulnerability where KeycloakSecurityPolicy with token introspection enabled useTokenIntrospection=true kept honouring an access token after i...

CVE-2026-3583

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

CVE-2026-3583 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

CVE-2026-3583

Multiple WSO2 products are affected by a vulnerability where the OAuth2 token introspection mechanism fails to immediately invalidate a token in the cache following a revocation request when the allowed_scopes configuration is enabled. This insufficient session expiration (CWE-613) allows a revok...

CVE-2026-3583 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

EUVD-2026-112400

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

CVE-2026-3583

When the "allowedscopes" configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be return...

PT-2026-129162

When the allowed scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returne...

WSO2 API Manager session mechanism vulnerability

Versions 3.1.0 through 3.1.0.367, 3.2.0 through 3.2.0.475, 3.2.1 through 3.2.1.106, 4.0.0 through 4.0.0.394, 4.1.0 through 4.1.0.267, 4.2.0 through 4.2.0.207, 4.3.0 through 4.3.0.120, 4.4.0 through 4.4.0.83, 4.5.0 through 4.5.0.67, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.3 contain a sessi...

CVE-2026-3583: WSO2: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately…

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the KeycloakSecurityProcessor in the camel-keycloak component. When token introspection and result caching are enabled, a caller can keep sending an access token that Camel introspected and cached whi...

CVE-2026-95663

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

CVE-2026-95663

The Apache Camel Keycloak component (versions 4.16.0 before 4.18.5, and 4.19.0 before 4.22.2) contains an Insufficient Session Expiration vulnerability (CWE-613) when useTokenIntrospection=true is enabled. The root cause is that both ConcurrentMapTokenCache and CaffeineTokenCache expire entries b...

EUVD-2026-109670

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

CVE-2026-95663 Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

CVE-2026-95663

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

CVE-2026-95663 Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

CVE-2026-95663 Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

PT-2026-123214

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy useTokenIntrospection=true, the security...

Vulnerability related to Apache Camel session mechanism issues

Versions of Apache Camel prior to 4.16.0 and between 4.18.5 and 4.19.0, as well as versions between 4.22.2 and 4.23.0, contain a session mechanism vulnerability. This vulnerability arises when token introspection is enabled; Keycloak Security Policy caches the results of such introspection withou...