CVE-2026-66908

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.8.0 through 4.21.x Apache Camel versions 4.14.x through 4.14.8 Apache Camel versions 4.18.x through 4.18.3

Description An improper authentication issue exists in the Apache Camel Platform HTTP Main component. When the embedded HTTP server is configured for JWT authentication using authenticationEnabled and JWT keystore properties, the JWTAuthenticationConfigurer.buildJwtOptions() function may return null if neither jwtIssuer nor jwtAudience is configured. This causes the system to skip the JWTAuthOptions.setJWTOptions() call, resulting in a Vert.x JWTAuth instance that only validates the token signature and expiry. Consequently, the issuer (iss) and audience (aud) claims are not validated, allowing any unexpired token signed by a trusted key in the keystore to be accepted, regardless of the intended audience or issuer. This affects both the application server and the management server.

Recommendations For versions 4.8.0 through 4.21.x, upgrade to version 4.22.0. For versions 4.14.x through 4.14.8, upgrade to version 4.14.9 and configure jwtIssuer, jwtAudience, or both. For versions 4.18.x through 4.18.3, upgrade to version 4.18.4 and configure jwtIssuer, jwtAudience, or both. Restrict the JWT keystore to the smallest possible trust set, preferably using a signer dedicated to the service. Ensure that any gateway validating issuer and audience in front of the server cannot be bypassed.