CVE-2026-95663
Camel-Keycloak: Security policy accepts expired access tokens because cached token introspection results are not bounded by the token expiry
Description
When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspection results are cached by default (introspectionCacheEnabled=true, introspectionCacheTtl=60 seconds), and both cache implementations shipped with the component, ConcurrentMapTokenCache and CaffeineTokenCache, expired an entry a fixed time after it was inserted, without bounding that lifetime by the exp claim that the cached response already carried. KeycloakSecurityProcessor in turn checked only the active flag of the result, on every path that uses introspection, and never compared exp with the current time. A response cached shortly before the token expired was therefore served to later requests carrying the same token for up to the configured time-to-live after the token's expiry, and those requests were admitted with the roles and permissions the expired token had carried, although RFC 7662, which defines token introspection, states that a response containing exp must not be cached beyond that time. The access token is supplied by the caller with each request, typically as a bearer token in the Authorization header, so a caller holding a token that was valid moments earlier could keep using it after it expired, for as long as the cached entry lived. The window is bounded by introspectionCacheTtl, which is 60 seconds by default and 300 to 600 seconds where the documentation's recommendation for internal services was followed, and it opens only for a token that the same Camel process introspected and cached while the token was still active. The issue grants nothing beyond what the token already carried: it allows no token forgery and no privilege escalation, and token introspection is not enabled by default, which is why the severity is assessed medium. The local JWT verification path, used when introspection is disabled, is not affected by this issue.
Mitigation
Credit
This issue was discovered by Andrea Cosentino from Apache Software Foundation
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24902 refers to the commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/26747 (commit 7bfacb70d3300f97a130eda92b7b86ec5d8b11af), and backported to camel-4.22.x in https://github.com/apache/camel/pull/27182 (commit 66fd7034911aebcaffa80bae4ece265feb2895bb) and to camel-4.18.x in https://github.com/apache/camel/pull/27183 (commit 6be02c19c0259a983db5910e28deb4b3a00c9d22).
Both cache implementations now bound the lifetime of each entry by the shorter of introspectionCacheTtl and the time remaining until the token’s exp, and a result whose token has already expired is never served from the cache. Independently of the cache, KeycloakSecurityProcessor now rejects a token whose exp lies in the past on every path that uses introspection, so expiry is enforced on the introspection path as it is on the local JWT verification path. A response that carries no exp claim keeps the configured time-to-live, and its expiry is left to the introspection endpoint as before. No option was added and no default changed, and the upgrade guide carries no entry for this change; the component documentation now states that a cached introspection result is never returned after the token has expired.
Token introspection was added to camel-keycloak in 4.16.0 together with the result cache, and the cache expired its entries by insertion time from the start, so every release from 4.16.0 up to the fixed versions is affected, the 4.18.x line included. Earlier releases are not affected: camel-keycloak 4.15.0, the release that introduced the component, has no token introspection support, and the 4.14.x line and earlier do not ship camel-keycloak at all.
This issue is distinct from CVE-2026-46455, which concerned the local JWT verification path: the token verifier there was built without its IS_ACTIVE check, so the validity window of a token was not enforced at all, and the fix in 4.18.3 and 4.21.0 added that check. When useTokenIntrospection is enabled the local verification path is not used and expiry is decided from the introspection response instead, so that fix did not reach the gap described here, which affects releases with and without it alike. It is also distinct from CVE-2026-85301, a separate gap on the same introspection path in which the issuer check was skipped when the response carried no iss claim; that issue was fixed in 4.22.1, so deployments on the 4.22.x line that upgraded to 4.22.1 for it still need 4.22.2 for this one. It is classified as CWE-613 (Insufficient Session Expiration).