CVE-2026-46455: Apache Camel-Keycloak Access Token Validation Bypass
Summary
CVE-2026-46455: Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. Affects org.apache.camel:camel-keycloak across 2 version ranges.
>= 4.18.0, < 4.18.3
>= 4.19.0, < 4.21.0
Fixed in 4.18.3 or 4.21.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Camel is an open-source integration framework that allows users to integrate various systems using a wide range of protocols and data formats. The Camel-Keycloak component provides security features for applications using Keycloak for authentication and authorization. This component is essential for ensuring secure communication and access control in applications. However, a critical vulnerability has been identified in the Keycloak integration, which could lead to unauthorized access if not addressed promptly.
Vulnerability Detail
The vulnerability arises from an Insufficient Session Expiration issue in the Apache Camel Keycloak Component. The KeycloakSecurityHelper.parseAndVerifyAccessToken method constructs a TokenVerifier that only performs basic checks, omitting the crucial IS_ACTIVE check that validates the token's expiration and not-before claims. This oversight allows expired or not-yet-valid access tokens to be accepted as valid, potentially leading to unauthorized access to routes that rely on this helper for authentication. The vulnerability affects versions of the camel-keycloak component from 4.18.0 before 4.18.3 and from 4.19.0 before 4.21.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.18.0, < 4.18.34.18.3 -
>= 4.19.0, < 4.21.04.21.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, implement a workaround by validating the access token's expiration (exp) and not-before (nbf) claims in your application routes before trusting the token. This can be done by checking the token's claims programmatically, ensuring that only valid tokens are processed.
Conclusion
The CVE-2026-46455 vulnerability in the Apache Camel-Keycloak component poses a significant risk by allowing expired access tokens to be accepted as valid. It is crucial for users to upgrade to the patched versions to mitigate this risk. Implementing workarounds can provide temporary relief, but upgrading is the recommended solution for long-term security.
See every vulnerability recorded for org.apache.camel:camel-keycloak →
FAQ
CVE-2026-46455 is a critical vulnerability in the Apache Camel-Keycloak component that allows expired access tokens to be accepted as valid due to a missing IS_ACTIVE check.
The vulnerability affects camel-keycloak versions from 4.18.0 before 4.18.3 and from 4.19.0 before 4.21.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
If you cannot upgrade immediately, enforce token expiration checks in your application routes to validate the access token's claims before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-keycloak.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
