Cyber ·
CVE-2026-95663: Apache Camel Keycloak accepts expired tokens due to introspection cache
Security advisory published on October 23, 2026: cached introspection results do not respect token expiry, so the camel-keycloak component may accept expired access tokens. CVSS 3.1 score of 4.8 (medium), with affected versions stated in the source.
Advisory CVE-2026-95663 describes insufficient session expiry in the Keycloak component of Apache Camel. According to the source, cached introspection results do not respect token expiry, which allows the component's security policy to accept tokens that have already expired. The source lists the affected versions: org.apache.camel:camel-keycloak from 4.16.0 before 4.18.5, and from 4.19.0 before 4.22.2. The CVSS 3.1 score is 4.8, medium severity, with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. The text was published by Andrea Cosentino on the oss-sec mailing list feed and is an automatic translation of the original content. To consult and verify, find the original advisory by its CVE name on the oss-sec list and check the version and vector in the official Apache Camel project notes before making any decision. This item is a security alert, not a tutorial on using Rota Nacional.