CVE-2026-95663

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.16.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.1

Description Insufficient session expiration in the Apache Camel Keycloak component occurs when token introspection is enabled via useTokenIntrospection=true. The KeycloakSecurityProcessor validates access tokens by querying Keycloak's OAuth 2.0 token introspection endpoint. By default, results are cached using ConcurrentMapTokenCache or CaffeineTokenCache based on the introspectionCacheTtl setting. These caches expire entries after a fixed duration without considering the exp (expiration) claim of the token. Consequently, a token that expires shortly after being cached may still be accepted as active until the cache entry expires, allowing requests to be admitted with the expired token's roles and permissions. This behavior violates RFC 7662, which prohibits caching introspection responses beyond the exp time. This issue only affects the introspection path and does not impact local JWT verification.

Recommendations Upgrade to version 4.23.0. For the 4.22.x stream, upgrade to 4.22.2. For the 4.18.x stream, upgrade to 4.18.5. For versions 4.16.x, 4.17.x, and 4.19.0 through 4.21.x, migrate to a supported release as these versions have reached end of life. As a temporary workaround, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy to ensure every request is validated directly against the introspection endpoint.