Apache Camel OAuth Authentication Bypass Allows Unauthenticated Route Execution

Apache fixed CVE-2026-80312, an authentication bypass in its camel-oauth component that lets requests reach protected route endpoints when authentication fails or remains incomplete. The processors returned normally instead of stopping the exchange, allowing downstream steps to execute and overwrite rejection or redirect responses. Affected paths include missing or malformed bearer authorization headers, unauthenticated code-flow redirects, and callbacks without authorization codes. The flaw occurs during ordinary OAuth-protected request processing and requires neither special configuration nor prior caller access.

Organizations using camel-oauth should upgrade to Camel 4.23.0, 4.22.1, or 4.18.5, which stop unauthenticated exchanges; missing or malformed bearer credentials now receive HTTP 401 with a Bearer authentication challenge. The CAMEL-24411 fix was merged into the main branch and backported to the 4.18.x and 4.22.x branches, with regression tests covering all three denial paths while preserving authenticated requests and logout behavior. Where upgrades must be delayed, administrators should add an explicit authorization check immediately after the OAuth processor and verify that failed authentication halts routing. Deployments on the end-of-life 4.14.x line should migrate to 4.18.5 or later.