CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

As cited

Copy frozen at 2026-10-23 15:37 UTC (site build).

vulnerabilities

CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Apache Camel's Keycloak security policy component fails to invalidate cached authentication tokens after expiration, allowing expired credentials to remain valid for application programming interface (API) requests. The vulnerability affects versions 4.16.0 through 4.18.4 and 4.19.0 through 4.22.1, with a CVSS score of 4.8 (medium severity).

Why it matters: Organizations running Apache Camel with Keycloak authentication need to patch immediately, as expired user tokens can bypass access controls and grant unauthorized access to protected resources.

Source published

2026-10-23 13:22 UTC

First seen by Cybersecurity Tracker

2026-10-23 14:50 UTC