Improper Authentication in Apache Camel - CVE-2026-66908
Published: August 25, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass JWT authentication.
The vulnerability exists due to improper authentication in JWT authentication handling in the camel-platform-http-main component when processing JWT-protected requests with a configured keystore but without issuer or audience validation. A remote attacker can present a valid unexpired token signed by a trusted key to bypass JWT authentication.
Both the application server and the management server are affected. The issue occurs when JWT authentication is enabled with keystore properties and neither issuer nor audience is configured.
Affected software
How to mitigate CVE-2026-66908
Install security update from vendor's website.
Note, releases 4.14.9 and 4.18.4 are treated here as affected, as they do not introduce a patch. Therefore after updating to one of these versions users are advised to set jwtIssuer, jwtAudience, or both to mitigate the vulnerability.