Vulnerability	Vulnerable Version
H Missing Critical Step in Authentication Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the `authenticateUser()` method in `ShiroSecurityProcessor` in the Shiro component. An attacker can access Shiro-protected routes as an authenticated user by sending an exchange that names a principal already bound to a reused worker thread, without valid credentials of their own; the processor accepts the exchange without verifying its password. This occurs when `alwaysReauthenticate=false` and the prior subject remains bound to the thread. Notes The authentication bypass is gated on `alwaysReauthenticate=false`; the default is `true`, which logs out the subject after each exchange and masks the flaw. Workarounds Clear the Shiro subject from the thread at the end of every exchange to prevent a reused worker thread from carrying an authenticated subject into a later exchange. How to fix Missing Critical Step in Authentication? Upgrade `org.apache.camel:camel-shiro` to version 4.18.5, 4.22.1 or higher.	[4.0.0,4.18.5)[4.19.0,4.22.1)

Missing Critical Step in Authentication

Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the authenticateUser() method in ShiroSecurityProcessor in the Shiro component. An attacker can access Shiro-protected routes as an authenticated user by sending an exchange that names a principal already bound to a reused worker thread, without valid credentials of their own; the processor accepts the exchange without verifying its password. This occurs when alwaysReauthenticate=false and the prior subject remains bound to the thread.

Notes

The authentication bypass is gated on alwaysReauthenticate=false; the default is true, which logs out the subject after each exchange and masks the flaw.

Workarounds

Clear the Shiro subject from the thread at the end of every exchange to prevent a reused worker thread from carrying an authenticated subject into a later exchange.

How to fix Missing Critical Step in Authentication?

Upgrade org.apache.camel:camel-shiro to version 4.18.5, 4.22.1 or higher.

[4.0.0,4.18.5)[4.19.0,4.22.1)

Go back to all versions of this package