CVE-2026-95663: Apache Camel Keycloak security policy token expiration bypass

CVE-2026-95663 · Severity: medium · CVSS 4.8 · Published 2026-10-26

Apache Camel's Keycloak component caches OAuth token validation results for up to 60 seconds by default. When token introspection is enabled, expired tokens may continue to be accepted during the cache window, allowing an attacker with a recently-expired token to access resources that token was authorized for.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-95663 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-95663 being exploited in the wild.
How severe is CVE-2026-95663?
Medium severity, with a CVSS score of 4.8, published 26 October 2026.
Which products and versions are affected?
Apache Camel 4.16.0 to 4.18.4, 4.19.0 to 4.22.1.
Is there a fix for CVE-2026-95663?
Yes: fixed in Camel 4.18.5, 4.22.2, 4.23.0. Until then: Set introspectionCacheEnabled=false on the KeycloakSecurityPolicy to bypass caching and validate every request against the introspection endpoint, eliminating the grace window but at the cost of one introspection call per request. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95663 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-95663?
Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Camel 4.18.5, 4.22.2, 4.23.0

Set introspectionCacheEnabled=false on the KeycloakSecurityPolicy to bypass caching and validate every request against the introspection endpoint, eliminating the grace window but at the cost of one introspection call per request.

Technical details

The KeycloakSecurityPolicy component validates access tokens via Keycloak's OAuth 2.0 introspection endpoint when useTokenIntrospection=true. The cache implementations (ConcurrentMapTokenCache, CaffeineTokenCache) expire entries based on insertion time rather than the token's exp claim, and the processor only checks the active flag without comparing exp to current time. This allows expired tokens cached shortly before expiry to be accepted for the duration of introspectionCacheTtl (default 60 seconds), violating RFC 7662.

Affected products

  • Apache Camel 4.16.0 to 4.18.4, 4.19.0 to 4.22.1

Timeline

  • 2026-10-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.