The Apache Camel Keycloak component's KeycloakSecurityPolicy performs token presence checks but skips full token verification (signature, issuer, expiry) when both requiredRoles and requiredPermissions are empty, which is the default 'Basic Setup'. This means any non-null bearer token, including forged or unsigned tokens, is accepted, allowing unauthenticated access to protected routes. This vulnerability affects versions 4.15.0 before 4.18.3 and 4.19.0 before 4.21.0. The flaw is independent of a previous CVE (2026-23552) and remains in default configurations. The vendor recommends upgrading to 4.21.0 or 4.18.3 and/or configuring non-empty requiredRoles or requiredPermissions or disabling token acceptance from headers to enforce token verification.

Unauthenticated users can bypass authentication checks on routes protected by the KeycloakSecurityPolicy in default configurations, potentially gaining unauthorized access to server-side functionality. If the protected route forwards requests to components capable of executing code, this can lead to unauthenticated remote code execution. This undermines the security guarantees of the authentication mechanism and exposes sensitive operations to attackers.

A fix is available in Apache Camel Keycloak versions 4.21.0 and 4.18.3. Users should upgrade to these versions to resolve the vulnerability. For deployments unable to upgrade immediately, configure KeycloakSecurityPolicy with non-empty requiredRoles or requiredPermissions to ensure token verification is performed. Alternatively, set allowTokenFromHeader to false if tokens are not expected in request headers, or perform token verification at the framework layer before the policy is applied.