CVE-2026-46455
Received Received - Intake

Insufficient Session Expiration in Apache Camel Keycloak Component

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Apache Software Foundation

Description
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default checks are installed only when withDefaultChecks() is called - so the built-in IS_ACTIVE predicate, which validates the token's exp (expiration) and nbf (not-before) claims, is never applied. As a result the helper verifies the token signature, subject and issuer but does not enforce the token's validity window: an access token that is expired, or not yet valid, is accepted as valid. Routes that rely on this helper to authenticate inbound requests therefore accept access tokens that are outside their intended lifetime. This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes KeycloakSecurityHelper.parseAndVerifyAccessToken include the TokenVerifier.IS_ACTIVE check so that expired or not-yet-valid access tokens are rejected, aligning the helper with Keycloak's default check set. For deployments that cannot upgrade immediately, enforce token expiration outside the helper - for example validate the access token's exp/nbf claims in the route before trusting it, keep Keycloak access-token lifetimes short, and ensure any upstream gateway or resource server also validates the token validity window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-06
AI Q&A
2026-07-06
EPSS Evaluated
N/A
NVD
CVE-2026-46455
EUVD
EUVD-2026-41829

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache camel From 4.18.0 (inc) to 4.18.3 (exc)
apache camel From 4.19.0 (inc) to 4.21.0 (exc)
apache camel 4.18.3
apache camel 4.21.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46455 is a medium-severity vulnerability in the Apache Camel camel-keycloak component. The issue arises because the method KeycloakSecurityHelper.parseAndVerifyAccessToken does not properly verify the validity window of access tokens. Specifically, it uses a TokenVerifier that lacks the IS_ACTIVE check, which normally enforces token expiration (exp) and not-before (nbf) claims.

As a result, expired or not-yet-valid access tokens are accepted as valid. This means that routes relying on this helper for authentication may accept tokens outside their intended lifetime, potentially allowing unauthorized access.

Impact Analysis

This vulnerability can allow attackers to use expired or not-yet-valid access tokens to gain unauthorized access to protected routes or resources in applications using the affected Apache Camel versions. Since the token validity window is not enforced, authentication based on these tokens is weakened, potentially leading to improper authentication and unauthorized access.

Detection Guidance

This vulnerability involves the acceptance of expired or not-yet-valid Keycloak access tokens due to missing token validity checks in the Apache Camel Keycloak component.

To detect this vulnerability on your system, you should monitor and inspect the access tokens being accepted by your routes that use the camel-keycloak component. Specifically, check if tokens that are expired or not yet valid (based on their exp and nbf claims) are being accepted.

Since the vulnerability is related to token validation logic inside Apache Camel routes, detection involves verifying whether the token expiration and not-before claims are enforced.

Suggested commands or approaches include:

  • Extract and decode the JWT access tokens used in your system (for example, using jwt.io or command-line tools like 'jq' and 'base64').
  • Check the 'exp' (expiration) and 'nbf' (not before) claims in the tokens to see if any tokens accepted by your system are expired or not yet valid.
  • Use logging or debugging in your Apache Camel routes to log token claims and verify if expired tokens are processed.
  • If you have access to the system logs, search for authentication events that accepted tokens with expired or future validity timestamps.
Mitigation Strategies

The primary recommended mitigation is to upgrade Apache Camel to version 4.21.0 or, if you are on the 4.18.x stream, to version 4.18.3, where the vulnerability is fixed by adding the TokenVerifier.IS_ACTIVE check.

If immediate upgrade is not possible, implement temporary mitigations such as:

  • Manually validate the access token's expiration (exp) and not-before (nbf) claims within your routes before trusting the token.
  • Keep Keycloak access-token lifetimes short to reduce the window of exposure.
  • Ensure any upstream gateway or resource server also validates the token validity window to reject expired or not-yet-valid tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart