Camel Keycloak accepts expired tokens from unbounded cache (CVE-2026-95663)
Original title: CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
Cached introspection results are not limited by token expiry, so expired access tokens can still be accepted.
Andrea Cosentino reported CVE-2026-95663 in Apache Camel's camel-keycloak component. Cached token introspection results are not bounded by the access token's expiry, so the security policy can accept expired tokens. Apache rates it CVSS 3.1 4.8 (medium). Affected ranges are 4.16.0 before 4.18.5 and 4.19.0 before 4.22.2. The post is truncated after the trigger description, and no exploitation is mentioned.
Unconfirmed: The oss-security post is truncated, so the full trigger conditions are not shown.
- CVSS 3.1 base score is 4.8, rated medium.
- Vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
- camel-keycloak 4.16.0 before 4.18.5 is affected.
- camel-keycloak 4.19.0 before 4.22.2 is affected.
- The issue is classified as insufficient session expiration.
Impact: Accept expired access tokens via cached introspection
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-keycloak | 4.16.0 before 4.18.5; 4.19.0 before 4.22.2 | 4.18.5 and 4.22.2 |
- 1.Upgrade camel-keycloak to 4.18.5 or 4.22.2, matching the installed release line.
- CVEs
- CVE-2026-95663
- Vendors
- Apache
- Products
- Apache Camelcamel-keycloak
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95663 | Insufficient Session Expiration in Apache Camel Keycloak | 4.8 | — |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 4. 8 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.