CVE-2026-84178
Description
A flaw was found in Apache Camel's OAuth component. The authorization code callback endpoint fails to verify a state parameter binding the authorization request to the user's session. A remote attacker can exploit this vulnerability to perform a login Cross-Site Request Forgery (CSRF) attack, silently signing a victim into an attacker-controlled account and capturing subsequent actions and submitted sensitive data. Additionally, the unvalidated callback handling can allow an attacker to influence redirect targets, leading to open redirection.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires user interaction to complete an OAuth flow and is confined to applications that actively configure and expose the camel-oauth authorization code callback. In typical Red Hat deployments, Camel routes do not handle OAuth callback endpoints by default unless applications explicitly implement the camel-oauth component for user authentication. Although this flaw does not permit remote code execution, an attacker can manipulate victim sessions to bind to external accounts or redirect users to unauthorized destinations.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
