org.apache.camel:camel-shiro@4.18.4

Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the authenticateUser() method in ShiroSecurityProcessor in the Shiro component. An attacker can access Shiro-protected routes as an authenticated user by sending an exchange that names a principal already bound to a reused worker thread, without valid credentials of their own; the processor accepts the exchange without verifying its password. This occurs when alwaysReauthenticate=false and the prior subject remains bound to the thread.

Notes

• The authentication bypass is gated on alwaysReauthenticate=false; the default is true, which logs out the subject after each exchange and masks the flaw.

Workarounds

• Clear the Shiro subject from the thread at the end of every exchange to prevent a reused worker thread from carrying an authenticated subject into a later exchange.

Upgrade org.apache.camel:camel-shiro to version 4.18.5, 4.22.1 or higher.