CVE-2026-80312
Description
A flaw was found in the Apache Camel OAuth component. When authentication fails, the route processor does not terminate the exchange and instead allows the request to proceed to protected endpoints. A remote, unauthenticated attacker can exploit this flaw to bypass authentication controls and gain unauthorized access to protected services.
Statement
Red Hat has evaluated this vulnerability as having an Important security impact because an unauthenticated remote attacker can completely circumvent access controls without requiring prior privileges or user interaction. The issue specifically affects deployments utilizing Camel routes configured with the camel-oauth component to enforce inbound authentication guards. Because failed authentication attempts fail open and do not halt message processing, sensitive upstream services and business logic exposed via these integration routes can be reached directly by unauthorized clients.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An incorrect implementation may allow authentication to be bypassed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
