CVE-2026-80312
Camel-OAuth: authentication bypass - the OAuth processors returned control to the route instead of stopping it when authentication could not be completed, so a request that failed authentication was processed as if it had succeeded
Description
The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.
Mitigation
Credit
This issue was discovered by Claude Security Scan Tool
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24411 refers to the various commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/25567 (commit a3a98e4c959f3a04d5e5540b60bf2cc36314e37c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25575 (commit 2c61e3387ca8a2b811f96eed0520c78e340c2141) and to camel-4.18.x in https://github.com/apache/camel/pull/25576 (commit 407f2829882475648fe5a575810e171dd0d1391d).
The issue is classified as CWE-287 Improper Authentication. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later.