Threat Intelligence Database

CVE-2026-84178 is a Cross-Site Request Forgery (CSRF) vulnerability in the Apache Camel OAuth component affecting versions from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows an attacker to redeem an authorization code obtained in any browser and associate it with a victim's session, causing the victim to be signed in as the attacker. This can lead to victim actions and data being linked to the attacker's account. Additionally, the vulnerability allows an open redirect from a trusted origin due to unvalidated post-authentication redirect targets. The issue is fixed in Apache Camel 4.23.0, 4.18.5 (LTS), and 4.22.1 (LTS).

CVE-2026-80312 is an improper authentication vulnerability in the Apache Camel OAuth component affecting versions from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue causes the OAuth processors guarding a route to fail open, allowing unauthenticated requests to proceed to protected endpoints. This occurs because the processors do not stop the exchange or return an error when authentication fails, contrary to expected behavior. Fixed in Apache Camel 4.18.5, 4.22.1, and 4.23.0, the processors now correctly halt the exchange on authentication failure. Users unable to upgrade immediately should implement explicit authorization checks after the OAuth processor to prevent unauthorized access.