Open-source package vulnerability · Maven

CVE-2026-23552: Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

criticalCVSS 3.1 9.1GHSA-c3f3-cc42-xr9v

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.

Published Feb 23, 2026 · Updated Feb 25, 2026

Affected packages

org.apache.camel:camel-keycloak

Ecosystem: Maven
Affected: >= 4.15.0, < 4.18.0
Fixed in: 4.18.0
Check: mvn dependency:tree -Dincludes=org.apache.camel:camel-keycloak

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries