Improper Authentication in Apache Camel - CVE-2026-53913
Published: August 24, 2026
Vulnerability identifier: #VU144687
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53913
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper authentication in KeycloakSecurityPolicy when handling requests with a bearer token in the Authorization header under the default configuration with no required roles or permissions. A remote attacker can send a request with any non-null bearer value to bypass authentication.
The issue occurs because token cryptographic verification is performed only during role or permission checks, which are skipped in the default configuration.
Affected software
Apache Camel
How to mitigate CVE-2026-53913
Install security update from vendor's website.
Apache Camel - addressed in versions 4.19.0, 4.21.0