Medium [CVE-2026-95663] Insufficient Session Expiration vulnerability in Apache Camel Keycloak component
This medium-severity Apache Software Foundation advisory covers CVE-2026-95663 affecting Apache Camel Keycloak.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Insufficient Session Expiration vulnerability in Apache Camel Keycloak component.
This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2.
When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active.
The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry.
Introspection results are cached by default (introspectionCacheEnabled=true, introspectionCacheTtl=60 seconds), and both cache implementations shipped with the component, ConcurrentMapTokenCache and CaffeineTokenCache, expired an entry a fixed time after it was inserted, without bounding that lifetime by the exp claim that the cached response already carried.
KeycloakSecurityProcessor in turn checked only the active flag of the result, on every path that uses introspection, and never compared exp with the current time.
- 4.16.0 before 4.18.5
- 4.19.0 before 4.22.2
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
- 4.18.5
- 4.22.2
- 4.23.0
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 4.23.0, which fixes the issue.
- If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.
- For deployments that cannot upgrade immediately, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy, so that every request is checked against the introspection endpoint, which reports an expired token as inactive, at the cost of one introspection call per request.
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-85301Oct 19, 2026Apache Camel Keycloak authentication bypass
- CVE-2026-53913Jul 6, 2026Apache Camel: Improper Authentication, Missing Authentication for Critical Function, Not
- CVE-2026-46455Jul 6, 2026Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
- CVE-2026-115748Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
- CVE-2026-115721Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.