Severity:
CVSS 3.1: 6.1 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-oauth) 4.11.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-oauth) 4.19.0 before 4.22.1
Description:
Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.
This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before
4.22.1.
The authorization code callback did not carry a state parameter binding it to
the authorization request that started the flow, and the callback did not
verify one. An authorization code obtained in any browser could therefore be
redeemed at the callback and associated with whichever session presented it,
which is login cross-site request forgery: a victim can be silently signed in
as an identity the attacker controls, so that actions the victim then performs,
and data they then submit, land in the attacker's account. The same unvalidated
callback handling also allowed the post-authentication redirect target to be
influenced, giving an open redirect from a trusted origin. The state check runs
before the authorization code is redeemed, so these paths are reachable without
any interaction with the identity provider.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The authorization request now issues a state
value bound to the session, and the callback rejects a request whose state is
absent or does not match, stopping the route with a 400 response. For
deployments that cannot upgrade immediately, terminate the authorization code
flow in a component that performs its own state binding rather than relying on
the Camel callback. Note that after upgrading, a deployment behind a proxy that
drops or rewrites the callback query string will begin to see 400 responses,
because the state parameter must survive the round trip.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The authorization request now issues a state
value bound to the session, and the callback rejects a request whose state is
absent or does not match, stopping the route with a 400 response.
Work Arounds:
For deployments that cannot upgrade immediately, terminate the authorization
code flow in a component that performs its own state binding rather than
relying on the Camel callback. Note that after upgrading, a deployment behind a
proxy that drops or rewrites the callback query string will begin to see 400
responses, because the state parameter must survive the round trip.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-84178.html
https://issues.apache.org/jira/browse/CAMEL-24437
https://github.com/apache/camel/pull/25821
https://github.com/apache/camel/pull/25944
https://github.com/apache/camel/pull/25946
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-84178
