Apache Camel OAuth cache reuses tokens across scopes (CVE-2026-94386)
Original title: CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
camel-oauth from 4.19.0 before 4.22.2 can reuse client-credentials bearer tokens; CVSS 3.1 is 4.8.
Andrea Cosentino reported a medium-severity flaw in Apache Camel's OAuth component. OAuthClientCredentialsTokenResolver keeps client-credentials bearer tokens in an under-keyed JVM-global cache, allowing cross-scope reuse. It affects org.apache.camel:camel-oauth from 4.19.0 before 4.22.2. The post does not mention attacks.
- CVSS 3.1 base score is 4.8, rated medium.
- Vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
- The affected artifact is org.apache.camel:camel-oauth.
- The stated fixed release is 4.22.2.
Impact: cross-scope reuse of OAuth bearer tokens
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-oauth | 4.19.0 before 4.22.2 | 4.22.2 |
- 1.Upgrade org.apache.camel:camel-oauth to 4.22.2.
- CVEs
- CVE-2026-94386
- Vendors
- Apache
- Products
- Apache Camelcamel-oauth
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94386 | Under-keyed OAuth token cache in Apache Camel before 4.22.2 | 4.8 | — |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 4. 8 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.