org.apache.camel:camel-keycloak 4.18.2

Direct Vulnerabilities

Known vulnerabilities in the org.apache.camel:camel-keycloak package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Insufficient Session Expiration Affected versions of this package are vulnerable to Insufficient Session Expiration via `KeycloakSecurityHelper.parseAndVerifyAccessToken` in the `camel-keycloak` component. An attacker can authenticate with an expired or not-yet-valid access token by sending a signed token to code paths that rely on this helper. The helper verifies the token signature, subject, and issuer but does not enforce the token validity window, so routes that trust it accept access tokens outside their intended lifetime and continue treating them as valid. How to fix Insufficient Session Expiration? Upgrade `org.apache.camel:camel-keycloak` to version 4.18.3, 4.21.0 or higher.	[4.18.0,4.18.3)[4.19.0,4.21.0)
H Improper Authentication Affected versions of this package are vulnerable to Improper Authentication in the `KeycloakSecurityPolicy` process. An attacker can gain unauthorized access to protected routes by supplying any non-null value in the Authorization: Bearer header, which is accepted without cryptographic verification of the token's validity. This can lead to unauthenticated access to server-side operations, and in cases where the protected route forwards to a code-execution-capable producer, it may result in unauthenticated remote code execution. How to fix Improper Authentication? Upgrade `org.apache.camel:camel-keycloak` to version 4.18.3, 4.21.0 or higher.	[4.15.0,4.18.3)[4.19.0,4.21.0)

Vulnerability

Vulnerable Version

Insufficient Session Expiration

Affected versions of this package are vulnerable to Insufficient Session Expiration via KeycloakSecurityHelper.parseAndVerifyAccessToken in the camel-keycloak component. An attacker can authenticate with an expired or not-yet-valid access token by sending a signed token to code paths that rely on this helper. The helper verifies the token signature, subject, and issuer but does not enforce the token validity window, so routes that trust it accept access tokens outside their intended lifetime and continue treating them as valid.

How to fix Insufficient Session Expiration?

Upgrade org.apache.camel:camel-keycloak to version 4.18.3, 4.21.0 or higher.

[4.18.0,4.18.3)[4.19.0,4.21.0)

Improper Authentication

Affected versions of this package are vulnerable to Improper Authentication in the KeycloakSecurityPolicy process. An attacker can gain unauthorized access to protected routes by supplying any non-null value in the Authorization: Bearer header, which is accepted without cryptographic verification of the token's validity. This can lead to unauthenticated access to server-side operations, and in cases where the protected route forwards to a code-execution-capable producer, it may result in unauthenticated remote code execution.

How to fix Improper Authentication?

Upgrade org.apache.camel:camel-keycloak to version 4.18.3, 4.21.0 or higher.

[4.15.0,4.18.3)[4.19.0,4.21.0)

org.apache.camel:camel-keycloak@4.18.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically