CVE-2026-23552

CWE-3466 documents6 sources
Severity
9.1CRITICAL
EPSS
0.1%
top 82.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache CamelApache Camel
Timeline
PublishedFeb 23

Description

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶Mavenorg.apache.camel:camel-keycloak4.15.0 — 4.18.0
▶NVDapache/camel4.15.0 — 4.18.0
▶CVEListV5apache_software_foundation/apache_camel4.15.0 — 4.18.0

🔴Vulnerability Details

3
CVEList
Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy↗2026-02-23
▶
GHSA
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm↗2026-02-23
▶
OSV
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm↗2026-02-23
▶

📋Vendor Advisories

1
Apache
Apache camel: CVE-2026-23552↗
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-23552 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-23552 (CRITICAL CVSS 9.1) | Cross-Realm Token Acceptance Bypass | cvebase.io