CVE-2026-80312

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.11.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description An improper authentication issue exists in the Apache Camel OAuth component. The camel-oauth processors designed to guard routes fail to stop the exchange when authentication cannot be completed. Instead of terminating the routing process and returning an error, the processors allow the request to proceed to the protected endpoint as if authentication had succeeded. This creates a fail-open authentication guard, allowing unauthenticated callers to access protected resources via the ordinary request path of a route configured for OAuth.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.18.5 for those on the 4.18.x LTS stream. Upgrade to version 4.22.1 for those on the 4.22.x LTS stream. As a temporary workaround, place an explicit authorization check after the OAuth processor and verify that the route stops on failure.