EUVD-2026-41829
GHSA-mqwc-6qwc-v9gq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because the attacker must first obtain a genuine expired/not-yet-valid token; PR:N since no live credentials are checked; A:N as the impact is unauthorized access, not availability loss.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6Blast Radius
ecosystem impact- 4 maven packages depend on org.apache.camel:camel-keycloak (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 4.18.0.
DescriptionCVE.org
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.
The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default checks are installed only when withDefaultChecks() is called - so the built-in IS_ACTIVE predicate, which validates the token's exp (expiration) and nbf (not-before) claims, is never applied. As a result the helper verifies the token signature, subject and issuer but does not enforce the token's validity window: an access token that is expired, or not yet valid, is accepted as valid. Routes that rely on this helper to authenticate inbound requests therefore accept access tokens that are outside their intended lifetime. This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.
Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes KeycloakSecurityHelper.parseAndVerifyAccessToken include the TokenVerifier.IS_ACTIVE check so that expired or not-yet-valid access tokens are rejected, aligning the helper with Keycloak's default check set. For deployments that cannot upgrade immediately, enforce token expiration outside the helper - for example validate the access token's exp/nbf claims in the route before trusting it, keep Keycloak access-token lifetimes short, and ensure any upstream gateway or resource server also validates the token validity window.
AnalysisAI
Authentication token-lifetime bypass in the Apache Camel Keycloak component (camel-keycloak) affects versions 4.18.0-4.18.2 and 4.19.0-4.20.x, allowing expired or not-yet-valid Keycloak access tokens to be accepted as valid. The KeycloakSecurityHelper builds its TokenVerifier via withChecks() with only subject and issuer checks, so Keycloak's IS_ACTIVE exp/nbf validation is never installed, and any route relying on this helper will trust tokens outside their intended lifetime. NVD scores it CVSS 9.8, though EPSS is low (0.15%, 5th percentile) and there is no public exploit identified at time of analysis.
Technical ContextAI
Apache Camel is a Java enterprise integration framework; the camel-keycloak component (introduced in the 4.18 line) provides Keycloak-based authentication for inbound route requests. The root cause is CWE-613 (Insufficient Session Expiration): Keycloak's org.keycloak.TokenVerifier.withChecks(...) appends predicates to an initially empty check list rather than augmenting the defaults, which are only added by withDefaultChecks(). Because KeycloakSecurityHelper.parseAndVerifyAccessToken supplies only the subject-exists and realm-URL (issuer) checks, the built-in IS_ACTIVE predicate that evaluates the JWT 'exp' (expiration) and 'nbf' (not-before) claims is silently omitted. The token signature, subject and issuer are still validated correctly, so cryptographic trust is intact - only the temporal validity window goes unenforced.
RemediationAI
Vendor-released patch: upgrade to Apache Camel 4.21.0; deployments on the 4.18.x stream should upgrade to 4.18.3. The fix restores the TokenVerifier.IS_ACTIVE check in KeycloakSecurityHelper.parseAndVerifyAccessToken so expired and not-yet-valid access tokens are rejected, aligning the helper with Keycloak's default check set. For deployments that cannot upgrade immediately, validate the access token's exp/nbf claims directly in the route before trusting it (closes the exact gap but requires custom code), keep Keycloak realm access-token lifetimes short to shrink the abuse window (trade-off: more frequent token refresh/re-authentication load), and ensure any upstream API gateway or downstream resource server independently validates the token validity window so the Camel helper is not the sole enforcement point. See https://camel.apache.org/security/CVE-2026-46455.html.
More in Apache Camel
View allRemote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0)
Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoS
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket messag
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remot
Remote code execution in Apache Camel 3.18.0-4.14.5 and 4.15.0-4.18.1 stems from CXF and Knative HeaderFilterStrategy im
Message header injection in Apache Camel's camel-mail component (3.0.0 before 4.14.6 and 4.15.0 before 4.18.1) lets an a
Remote code execution via unsafe Java deserialization affects the camel-pqc component of Apache Camel 4.18.0-4.18.2 and
Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize)
Cypher injection in Apache Camel's camel-neo4j producer allows attackers who control JSON key names in the CamelNeo4jMat
Remote code execution in the Apache Camel camel-hazelcast component allows an attacker who can join or reach the Hazelca
Remote code execution in Apache Camel's camel-vertx-http component (4.0.0-4.14.7, 4.15.0-4.18.2, 4.19.0) arises when a p
Blind out-of-band data exfiltration in Apache Camel 4.14.0-4.20.x arises because the default ObjectInputFilter pattern b
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today