A vulnerability in the Apache Camel OAuth component allows token caching to serve OAuth 2.0 bearer tokens across profiles sharing the same token endpoint and client ID but differing in scope or client secret. This can cause a profile to use a token issued for another profile's scope or client secret, potentially granting broader access than intended. The issue affects Apache Camel versions from 4.19.0 before 4.22.2. Upgrading to 4.23.0 or 4.22.2 resolves the issue. As a temporary mitigation, token caching can be disabled for affected profiles.