CVE-2026-80312: CWE-287 Improper Authentication in Apache Software Foundation Apache Camel

The vulnerability in Apache Camel's OAuth component causes the authentication guard to fail open. Specifically, when authentication cannot be completed, the camel-oauth processors do not stop the message exchange or return an error, allowing unauthenticated requests to continue to protected routes. This flaw affects Apache Camel versions >=4.11.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in versions 4.18.5, 4.22.1, and 4.23.0, where the processors properly halt the exchange and set error status on authentication failure. For deployments that cannot upgrade immediately, an explicit authorization check after the OAuth processor is recommended to ensure the route stops on failure.

An unauthenticated attacker can bypass OAuth authentication guards on affected Apache Camel routes, gaining unauthorized access to protected endpoints. This results in a fail-open authentication mechanism, potentially exposing sensitive functionality or data. The vulnerability has a high severity with a CVSS 3.1 score of 8.2, indicating a network attack vector with no privileges or user interaction required, causing high confidentiality impact and low integrity impact.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, 4.22.1 if using the 4.22.x LTS stream, or 4.23.0 or later. These versions include an official fix that ensures the OAuth processors halt the exchange and return an error on authentication failure. For environments where immediate upgrade is not feasible, implement an explicit authorization check immediately after the OAuth processor in the route to verify authentication success and stop processing on failure.