Authentication Bypass by Primary Weakness Affecting org.apache.camel:camel-oauth package, versions [4.11.0,4.18.5)[4.19.0,4.22.1)

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the OAuthBearerTokenProcessor, OAuthCodeFlowProcessor, and OAuthCodeFlowCallback in the camel-oauth component. An unauthenticated attacker can reach the protected endpoint by sending a request with no usable bearer Authorization header, making a request that triggers the unauthenticated code-flow redirect, or submitting a callback without an authorization code. Because these processors return control to the route after preparing an error response or redirect, subsequent steps still run and may perform protected actions or overwrite the response. This affects routes configured to require OAuth and requires no prior access or special attacker-side setup.

Notes

• At the bearer-token entry point, the fail-open path is limited to a missing Authorization header or one that does not parse as Bearer <token>; a present but invalid token propagates an authentication exception instead of falling through.
• At the code-flow callback entry point, the fall-through occurs when the request lacks the code parameter.

Workarounds

• Add an explicit authorization check after the OAuth processor, and configure the route to stop when that check fails, so unauthenticated requests cannot reach subsequent protected steps.

• Apache Jira Issues
• camel.apache.org
• GitHub Commit camel-4.18.5
• GitHub Commit camel-4.22.1
• GitHub Commit camel-4.23.0