CVE-2026-46455

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x

Description Insufficient session expiration in the Apache Camel Keycloak Component occurs because the KeycloakSecurityHelper.parseAndVerifyAccessToken() function fails to apply the IS ACTIVE predicate. This predicate is responsible for validating the exp (expiration) and nbf (not-before) claims of a token. Consequently, while the helper verifies the token signature, subject, and issuer, it does not enforce the validity window, allowing expired or not-yet-valid access tokens to be accepted as valid for inbound request authentication.

Recommendations Upgrade to version 4.18.3 for those on the 4.18.x release stream. Upgrade to version 4.21.0. As a temporary mitigation, validate the exp and nbf claims of the access token within the route before trusting it. Keep Keycloak access-token lifetimes short. Ensure any upstream gateway or resource server validates the token validity window.