Camel OAuth fail-open bypasses auth (CVE-2026-80312) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-80312 is a high-severity authentication bypass in Apache Camel 4.11.0 before 4.18.5 and 4.19.0 before 4.22.1 that lets unauthenticated callers reach routes protected by the camel-oauth processors. Fixed releases are 4.23.0, 4.18.5 and 4.22.1.

Overview

CVE-2026-80312 is an improper authentication vulnerability in the Apache Camel OAuth component. The camel-oauth processors are meant to guard a route: when an authenticated session cannot be established, they should stop the exchange and return an error to the caller. In affected versions they do not. Instead of halting, the processors fall through and hand control back to the route, so the request continues to the protected endpoint as if authentication had succeeded.

The result is a fail-open authentication guard. Any caller able to reach a route that depends on the OAuth processor for access control arrives at whatever the route does next with no session at all. Nothing unusual is required: this sits on the ordinary request path of a route configured to require OAuth, and the attacker needs no prior access, no valid credentials, and no user interaction.

Impact

A route that trusts camel-oauth as its only gatekeeper will process unauthenticated requests as legitimate. What that means in practice depends on the route, but it can include exposing data or actions that were only ever intended for authenticated users, and undermining any downstream system that assumes Camel already verified the caller. The CVSS score of 8.2 reflects network reachability, low attack complexity, and no privileges required. The flaw is not currently known to be exploited, but it is a straightforward authentication bypass that is easy to trigger repeatedly against any exposed route.

Remediation and Mitigation

Upgrade Apache Camel. The fix ships in 4.23.0; users tracking the 4.18.x LTS stream should move to 4.18.5, and 4.22.x users to 4.22.1. In the fixed versions the processors stop the exchange and set an appropriate error status whenever an authenticated session cannot be established, so a failed login never reaches the protected part of the route.

If you cannot upgrade immediately:

• Add an explicit authorization check after the OAuth processor instead of relying on it to halt the exchange.
• Test that your routes actually stop on authentication failure, and confirm the error propagates to the caller rather than falling through.

Security Insight

A guard that defaults to open on error is one of the more uncomfortable failure modes to find in an integration framework, because everything looks correct in normal operation: the happy path works, the routes pass review, and the defect only appears when authentication fails, which is precisely when you are relying on it. This is the same class of logic error that has shown up repeatedly in access-control components across the ecosystem, where the check exists but its failure branch does not terminate. For teams running Camel, the takeaway is to treat third-party auth processors as advisory and enforce the final decision inside the route itself. For a broader view of how quickly such flaws attract attention once disclosed, see our coverage of Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo.

Further Reading

• Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs