CVE-2026-84178: CWE-352 Cross-Site Request Forgery (CSRF) in Apache Software Foundation Apache Camel

The vulnerability in Apache Camel OAuth component arises because the authorization code callback does not include or verify a state parameter binding it to the original authorization request. This omission allows an attacker to reuse an authorization code in any browser and associate it with a victim's session, effectively causing login CSRF. The attacker can influence the victim's session to be signed in as the attacker, causing victim actions and data to be linked to the attacker's account. The callback also allows an open redirect by permitting manipulation of the post-authentication redirect target. The state parameter check was added in fixed versions to reject requests missing or having mismatched state values, returning a 400 response. Deployments behind proxies that alter query strings may see 400 errors until configured properly. For those unable to upgrade immediately, terminating the authorization code flow in a component that performs its own state binding is recommended.

An attacker can cause a victim to be silently signed in as the attacker by exploiting the lack of state parameter verification in the OAuth callback, leading to victim actions and data being associated with the attacker's account. The vulnerability also allows an open redirect from a trusted origin, which can be abused for phishing or redirect attacks. The CVSS score is 6.1 (medium severity), indicating a moderate impact with low complexity and requiring user interaction.

Upgrade Apache Camel to version 4.23.0 or later. For users on the 4.18.x LTS stream, upgrade to 4.18.5, and for the 4.22.x LTS stream, upgrade to 4.22.1. These versions include the fix that enforces state parameter binding and verification in the OAuth authorization code callback. For deployments unable to upgrade immediately, terminate the authorization code flow in a component that performs its own state binding rather than relying on the vulnerable Camel callback. Additionally, ensure that proxies do not drop or rewrite the callback query string parameters, as this will cause legitimate requests to be rejected with a 400 response.