CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

As cited

Copy frozen at 2026-10-23 15:37 UTC (site build).

vulnerabilities

CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Apache Camel versions 4.19.0 through 4.22.1 contain a vulnerability in the OAuth component where the OAuthClientCredentialsTokenResolver improperly caches bearer tokens using an under-keyed mechanism, allowing cross-scope token reuse. This cache flaw could permit an attacker to reuse tokens across different OAuth scopes or applications within the same JVM instance.

Why it matters: Developers and operators running Apache Camel with OAuth authentication should upgrade to version 4.22.2 or later to prevent token reuse attacks that could lead to unauthorized access across multiple scopes or services.

Source published

2026-10-23 13:14 UTC

First seen by Cybersecurity Tracker

2026-10-23 14:50 UTC