Executive brief
Apache Camel's embedded HTTP server component accepts JWT tokens for API authentication. When administrators configured JWT with a keystore but omitted optional issuer and audience settings, the server silently failed to validate those claims—accepting any unexpired token signed by the trusted keystore, regardless of who issued it or which service it was intended for. This authentication bypass could allow attackers with access to legitimately-issued tokens from other services or identity providers to access protected APIs.
Technical details
This is an improper authentication vulnerability (CWE-287) in the JWT claim validation logic of Apache Camel's embedded HTTP server. The JWTAuthenticationConfigurer.buildJwtOptions method returns null when neither jwtIssuer nor jwtAudience properties are configured, causing the caller to skip the JWTAuthOptions.setJWTOptions call. The resulting Vert.x JWTAuth instance built only from the keystore validates signature and expiry but not issuer (iss) or audience (aud) claims. An attacker with network access to the HTTP endpoints and possession of any unexpired JWT signed by a key in the configured keystore—regardless of its actual issuer or intended audience—can impersonate an authorized client. The vulnerability is silent: no warnings are logged and the server starts normally, making misconfiguration difficult to detect. Both the application and management servers are affected due to the same omission in both authentication paths. Versions 4.8.0–4.21.x have no supported configuration option to enforce these claims; 4.14.9 and 4.18.4 backport configuration options but do not change the unsafe default; 4.22.0 introduces a fail-closed behavior requiring explicit opt-in to disable claim validation.
Affected products
- Apache Camel Platform HTTP Main 4.8.0 through 4.21.x (unpatched); 4.22.0+ (patched); 4.14.9 and 4.18.4 with partial mitigation
Timeline
- 2026-08-24: disclosed: Vulnerability disclosed in CVE-2026-66908 and GHSA-fpm2-m4qq-wghr
- 2026: patched: Fixed in version 4.22.0 with fail-closed behavior and new jwtAllowMissingIssuerAndAudience option
- 2026: patched: Partial mitigation via jwtIssuer and jwtAudience configuration options in versions 4.14.9 and 4.18.4, but unsafe default remains