Cross-Site Request Forgery Vulnerability in Apache Camel OAuth Component

CVE-2026-84178

What is CVE-2026-84178?

The vulnerability within the Apache Camel OAuth component allows attackers to exploit sessions without proper state validation in the authorization code callback. This design flaw can enable an attacker to recycle authorization codes from arbitrary browsers, leading to unauthorized access where the victim unknowingly acts as the attacker. The misconfigured state parameter during authorization requests fails to bind correctly across sessions, allowing potential open redirects and CSRF attacks. To mitigate this risk, immediate upgrades are advised to versions 4.23.0 or 4.18.5, which implement proper state value binding and validation.

References