CVE-2026-85301: CWE-287 Improper Authentication in Apache Software Foundation Apache Camel

The vulnerability in Apache Camel's Keycloak component arises from improper authentication due to incomplete validation of the issuer claim in OAuth2 token introspection responses. Specifically, the security processor validates the issuer only if the introspection response includes an iss claim. If the iss claim is absent, the check is skipped rather than treated as a failure, allowing tokens from issuers other than the configured one to be accepted if the introspection endpoint accepts tokens from multiple issuers and omits the iss claim. This scenario is not the default Keycloak setup, resulting in a lower severity rating. The issue affects Apache Camel versions >=4.15.0 <4.18.5 and >=4.19.0 <4.22.1. The fix, introduced in versions 4.18.5, 4.22.1, and 4.23.0, changes the behavior so that an absent iss claim causes validation failure. Mitigation for those who cannot upgrade immediately includes ensuring the introspection endpoint returns the iss claim and supports only a single issuer.

If exploited in environments where the introspection endpoint omits the iss claim and accepts tokens from multiple issuers, this vulnerability allows authentication of callers that should be rejected. This could lead to unauthorized access with limited impact on confidentiality and integrity, as reflected by the CVSS score of 4.8 (medium severity). The default Keycloak configuration does not exhibit this behavior, reducing the likelihood and impact of exploitation.

A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to these versions to resolve the vulnerability. For deployments that cannot upgrade immediately, ensure that the introspection endpoint returns the iss claim and is configured to serve exactly one issuer to prevent acceptance of tokens from unauthorized issuers.