Insufficient Session Expiration in Apache Camel - Keycloak Component
CVE-2026-95663

4.8MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
26 October 2026

What is CVE-2026-95663?

The Apache Camel Keycloak component is vulnerable to insufficient session expiration due to the way token introspection results are cached. When the introspection feature is enabled, the system incorrectly accepts expired tokens, as it only checks if a token is active without comparing the expiration time against the current time. This flaw allows clients holding valid tokens to continue accessing resources after token expiration, limited to the configured caching duration. Users are advised to upgrade to version 4.23.0 or relevant patched versions depending on their current release stream to mitigate this vulnerability.

Affected Version(s)

Apache Camel 4.16.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.2

References

https://camel.apache.org/security/CVE-2026-95663.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24902
issue-tracking
https://github.com/apache/camel/pull/26747
patch

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Cosentino from Apache Software Foundation
Andrea Cosentino from Apache Software Foundation
.