CVE-2026-84178

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.11.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description A Cross-Site Request Forgery (CSRF) issue exists in the OAuth component. The authorization code callback lacks a state parameter to bind it to the initial authorization request and fails to verify one. This allows an attacker to associate an authorization code with a victim's session, leading to login CSRF where a victim is signed into an account controlled by the attacker. Additionally, the unvalidated callback handling enables an open redirect from a trusted origin by allowing the post-authentication redirect target to be influenced. These paths are accessible without interaction with the identity provider because the state check occurs before the authorization code is redeemed.

Recommendations Upgrade Apache Camel versions 4.11.0 through 4.18.4 to 4.18.5. Upgrade Apache Camel versions 4.19.0 through 4.22.0 to 4.22.1. Upgrade all other affected versions to 4.23.0. As a temporary workaround, terminate the authorization code flow in a component that performs its own state binding instead of using the Camel callback.