CYBER CODE RED

Get real-time updates on Telegram

VULNERABILITYOpen Source Security

CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3.1: 4.8 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected versions: - Apache Camel (org.apache.camel:camel-keycloak) 4.16.0 before 4.18.5 - Apache Camel (org.apache.camel:camel-keycloak) 4.19.0 before 4.22.2 Description: Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2.

Published 23-Oct-2026 17:33 UTC · First seen 23-Oct-2026 17:32 UTC

Sources