CVE-2026-23552

Description

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

PUBLISHED Reserved 2026-01-14 | Published 2026-02-23 | Updated 2026-02-23 | Assigner apache

Problem types

CWE-346 Origin Validation Error

Product status

Credits

Andrea Cosentino finder

Andrea Cosentino remediation developer

References

www.openwall.com/lists/oss-security/2026/02/18/7

camel.apache.org/security/CVE-2026-23552.html vendor-advisory

github.com/oscerd/CVE-2026-23552 exploit

cve.org (CVE-2026-23552)

nvd.nist.gov (CVE-2026-23552)

Download JSON