CVE-2026-53913

CVE-2026-53913 — camel-keycloak Fail-Open Authentication Bypass Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CVE-2026-85301

CVE-2026-85301 — camel-keycloak: issuer validation bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-keycloak's KeycloakSecurityProcessor validated the issuer of an introspected token only when the introspection response actually carried aniss claim. When...

CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

CVE-2026-46455

CVE-2026-46455 — camel-keycloak Missing ISACTIVE Check Expired Tokens Accepted Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-keycloak 4.18.2 Cam...

io.kaoto.forage:forage-security-keycloak (>=1.5.0, <=1.6.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.39.0) +3 more potentially affected by CVE-2026-85301 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.22.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85301 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429428...

io.kaoto.forage:forage-security-keycloak (>=1.5.0, <=1.6.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.39.0) +3 more potentially affected by CVE-2026-85301 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.22.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =1.5.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85301 Source advisory: MEND:CVE-2026-85301...

io.kaoto.forage:forage-security-keycloak (>=1.3, <=1.4.1), org.apache.camel.karaf:camel-keycloak (>=4.18.1, <=4.18.4) +4 more potentially affected by CVE-2026-85301 via org.apache.camel:camel-keycloak (>=4.18.0, <=4.18.4)

org.apache.camel:camel-keycloak MAVEN version =4.18.0, =1.3, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.4 Source cves: CVE-2026-85301 Source advisory: MEND:CVE-2026-85301...

CVE-2026-53913 — Updated!

CVE-2026-53913 — camel-keycloak Fail-Open Authentication Bypass Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

Exploit for Insufficient Session Expiration in Apache Camel

camel-keycloak Missing ISACTIVE Check — Expired Tokens Accept...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46455 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892117...

io.kaoto.forage:forage-security-keycloak (1.3), org.apache.camel.karaf:camel-keycloak (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.18.0, <=4.18.2)

org.apache.camel:camel-keycloak MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46455 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892117...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via KeycloakSecurityHelper.parseAndVerifyAccessToken in the camel-keycloak component. An attacker can authenticate with an expired or not-yet-valid access token by sending a signed token to code paths tha...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the KeycloakSecurityPolicy process. An attacker can gain unauthorized access to protected routes by supplying any non-null value in the Authorization: Bearer header, which is accepted without cryptographic...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-53913 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-53913 Source advisory: GHSA-QVC3-6Q9X-95PJ...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-53913 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-53913 Source advisory: OSV:GHSA-QVC3-6Q9X-95PJ...

GHSA-MQWC-6QWC-V9GQ Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks... with only the subject-exists check and the realm-URL issuer check. Keycloak's...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46455 Source advisory: OSV:GHSA-MQWC-6QWC-V9GQ...

io.kaoto.forage:forage-security-keycloak (1.3), org.apache.camel.karaf:camel-keycloak (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.18.0, <=4.18.2)

org.apache.camel:camel-keycloak MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46455 Source advisory: GHSA-MQWC-6QWC-V9GQ...

io.kaoto.forage:forage-security-keycloak (1.3), org.apache.camel.karaf:camel-keycloak (>=4.18.1, <=4.18.2) +4 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.18.0, <=4.18.2)

org.apache.camel:camel-keycloak MAVEN version =4.18.0, =4.18.1, =3.32.0, =3.32.0, =3.32.0, =4.18.0, =4.18.2 Source cves: CVE-2026-46455 Source advisory: OSV:GHSA-MQWC-6QWC-V9GQ...

io.kaoto.forage:forage-security-keycloak (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-46455 via org.apache.camel:camel-keycloak (>=4.19.0, <=4.20.0)

org.apache.camel:camel-keycloak MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46455 Source advisory: GHSA-MQWC-6QWC-V9GQ...