# CVE-2026-95663: Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. - **Severity:** Medium 4.8 (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N`) - **Exploited in the wild:** Not known - **Fix available:** No - **Published:** 26 Oct 2026 - **Updated:** 26 Oct 2026 - **Also known as:** GHSA-44m5-wqhm-rq65 ## What is CVE-2026-95663? CVE-2026-95663 is a medium-severity vulnerability in Apache Camel, published on 26 Oct 2026. ### Official description Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspection results are cached by default (introspectionCacheEnabled=true, introspectionCacheTtl=60 seconds), and both cache implementations shipped with the component, ConcurrentMapTokenCache and CaffeineTokenCache, expired an entry a fixed time after it was inserted, without bounding that lifetime by the exp claim that the cached response already carried. KeycloakSecurityProcessor in turn checked only the active flag of the result, on every path that uses introspection, and never compared exp with the current time. A response cached shortly before the token expired was therefore served to later requests carrying the same token for up to the configured time-to-live after the token's expiry, and those requests were admitted with the roles and permissions the expired token had carried, although RFC 7662, which defines token introspection, states that a response containing exp must not be cached beyond that time. The access token is supplied by the caller with each request, typically as a bearer token in the Authorization header, so a caller holding a token that was valid moments earlier could keep using it after it expired, for as long as the cached entry lived. The window is bounded by introspectionCacheTtl, which is 60 seconds by default and 300 to 600 seconds where the documentation's recommendation for internal services was followed, and it opens only for a token that the same Camel process introspected and cached while the token was still active. The issue grants nothing beyond what the token already carried: it allows no token forgery and no privilege escalation, and token introspection is not enabled by default, which is why the severity is assessed medium. The local JWT verification path, used when introspection is disabled, is not affected by this issue. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.16.x, 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy, so that every request is checked against the introspection endpoint, which reports an expired token as inactive, at the cost of one introspection call per request. Lowering introspectionCacheTtl only narrows the window and does not close it. Weakness: CWE-613 (DEPRECATED: Insufficient Session Expiration) ## Which versions are affected by CVE-2026-95663? ## How do I fix CVE-2026-95663? No fix has been published for CVE-2026-95663 yet. Limit exposure of the affected software until one is available. ## Is CVE-2026-95663 being exploited? There is no known exploitation of CVE-2026-95663 in the wild and no public exploit code. Public exploit code: - Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus. (github_poc): https://github.com/oscerd/CVE-2026-95663 ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-95663 and fix it if it is affected. What it is: CVE-2026-95663 is a medium-severity vulnerability in Apache Camel, published on 26 Oct 2026. Exploitation: There is no known exploitation of CVE-2026-95663 in the wild and no public exploit code. Affected product: Apache Camel. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-95663/ (Markdown: https://insights.sbomify.com/CVE-2026-95663/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-95663 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95663 - OSV: https://osv.dev/vulnerability/CVE-2026-95663 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-95663/ Summaries are generated and may contain mistakes; the official description above is the record.