CVE-2026-95663: Expired Tokens Accepted in Apache Camel Keycloak

Expired tokens stay valid 60-600s in Camel Keycloak with introspection. Patches: 4.18.5, 4.22.2, 4.23.0.

CVE-2026-95663 is an Insufficient Session Expiration vulnerability in Apache Camel's camel-keycloak component. When token introspection is enabled, the component validates expired tokens if they remain cached within the cache TTL window (60 seconds by default, up to 600 seconds). This allows a user to continue using a token that has just expired, retaining the roles and permissions it carried when valid. The vulnerability affects Camel versions from 4.16.0 before 4.18.5 and from 4.19.0 before 4.22.2.

Severity is rated Medium (CVSS 4.8) because the vulnerability does not allow token forgery or privilege escalation beyond the expired token's original rights. The temporal window during which an expired token remains valid is bounded by the cache TTL (60–600 seconds). Additionally, token introspection is not enabled by default, significantly reducing overall impact. Status is verified: the CVE was published October 26, 2026, and a public reproducer appeared on GitHub October 29, 2026, demonstrating the issue on Camel Spring Boot and Camel Quarkus.

For organizations using camel-keycloak, verify whether useTokenIntrospection=true is enabled in your deployment. If so, immediate upgrade is recommended: version 4.23.0, version 4.22.2 if on 4.22.x, or version 4.18.5 if on 4.18.x. Versions 4.16.x, 4.17.x, 4.19.x–4.21.x are end-of-life and will not receive patches; migration to a supported version is required. If immediate upgrade is not possible, disable the cache by setting introspectionCacheEnabled=false, at the cost of one introspection call per request.

At a glance

What: Insufficient Session Expiration vulnerability in Apache Camel camel-keycloak. When token introspection is enabled (useTokenIntrospection=true), introspection results are cached. If the cache remains valid beyond the token's expiration (exp claim), the expired token continues to be accepted with the permissions and roles it originally held.
Severity: CVSS 4.8 (Medium). Does not allow token forgery, privilege escalation, or access beyond the expired token's original rights. Temporal window limited (60-600 seconds) by cache TTL.
Affected versions: From 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. Versions 4.16.x, 4.17.x, 4.19.x–4.21.x reached end-of-life and will not receive patches.
Fix: Upgrade to 4.23.0 (recommended), 4.22.2 (if on 4.22.x), or 4.18.5 (if on 4.18.x). Alternatively, disable introspection cache (introspectionCacheEnabled=false) until upgrade, at the cost of one introspection call per request.
Status: Published October 26, 2026. Public repository with reproducer for CVE-2026-95663 available since October 29, 2026. Official patches available.
Action: 1. If you use camel-keycloak with useTokenIntrospection=true, assess the risk for your environment (default cache TTL is 60 seconds). 2. Upgrade to indicated versions or disable cache until upgrading. 3. Not a default configuration, but verify if it's enabled in your deployment.

Sources: NVD, CVE-2026-95663

← All articles