CVE-2026-80312
Received Received - Intake

Improper Authentication in Apache Camel OAuth Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-80312
EUVD
EUVD-2026-104215

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.11.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Authentication issue in Apache Camel's OAuth component. When authentication fails, the processors did not stop the request processing, allowing unauthenticated users to bypass security checks and reach protected endpoints as if they were authenticated. This creates a fail-open scenario where security controls are bypassed.

Detection Guidance

Detect this vulnerability by checking Apache Camel OAuth component versions. Run commands like 'camel --version' or inspect dependency files (e.g., pom.xml for Maven) to verify if your version falls within affected ranges: 4.11.0 to <4.18.5, 4.19.0 to <4.22.1, or <4.23.0.

Impact Analysis

This vulnerability allows unauthorized users to access protected resources by bypassing authentication checks. Attackers could exploit this to gain access to sensitive data or perform actions they should not be permitted to do. The impact includes potential data breaches, unauthorized system access, and compromised integrity of applications relying on OAuth authentication.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR and HIPAA by allowing unauthorized access to personal or sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates secure authentication for protected health information. A fail-open authentication flaw violates these requirements, potentially resulting in legal penalties and loss of trust.

Mitigation Strategies

Upgrade Apache Camel to fixed versions: 4.23.0, 4.18.5 (LTS), or 4.22.1 (LTS). If immediate upgrade is impossible, add explicit authorization checks after OAuth processors and verify routes halt on failure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart