{"id":"CVE-2026-84178","kind":"vulnerability","aliases":["CVE-2026-84178"],"related":[],"title":"Apache Camel OAuth callback lets attackers force victims into their login","description":"Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.\n\n\n\nThis issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did not verify one. An authorization code obtained in any browser could therefore be redeemed at the callback and associated with whichever session presented it, which is login cross-site request forgery: a victim can be silently signed in as an identity the attacker controls, so that actions the victim then performs, and data they then submit, land in the attacker's account. The same unvalidated callback handling also allowed the post-authentication redirect target to be influenced, giving an open redirect from a trusted origin. The state check runs before the authorization code is redeemed, so these paths are reachable without any interaction with the identity provider.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The authorization request now issues a state value bound to the session, and the callback rejects a request whose state is absent or does not match, stopping the route with a 400 response. For deployments that cannot upgrade immediately, terminate the authorization code flow in a component that performs its own state binding rather than relying on the Camel callback. Note that after upgrading, a deployment behind a proxy that drops or rewrites the callback query string will begin to see 400 responses, because the state parameter must survive the round trip.","summary":"The Apache Camel OAuth component's authorization callback does not check a state parameter, so an authorization code from any browser can be redeemed in a victim's session. An attacker can thereby silently sign a victim in as the attacker's identity and redirect the victim from a trusted origin to an arbitrary site.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","java","oauth","package","self-hosted"],"not_affected_if":["no-camel-oauth-callback","patched-version"],"how_to_check":"- Check the Camel version in use, for example with `mvn dependency:list | grep camel-oauth` or the lockfile, and compare it with the affected ranges: `4.11.0` to before `4.18.5`, and `4.19.0` to before `4.22.1`.\n- Confirm whether the application exposes an OAuth authorization code callback route built on the Camel OAuth component.","fix":"- Upgrade Apache Camel to `4.23.0`.\n- On the 4.18.x LTS stream, upgrade to `4.18.5`.\n- On the 4.22.x LTS stream, upgrade to `4.22.1`.\n- Until upgrading, terminate the authorization code flow in a component that performs its own state binding instead of relying on the Camel callback.\n- After upgrading, make sure any proxy keeps the callback query string intact, since a dropped `state` parameter now returns 400.","status":"open","published_at":"2026-10-19T11:17:21+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:04:17+00:00","updated_at":"2026-10-25T04:04:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:04:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Camel to `4.23.0`.\n- On the 4.18.x LTS stream, upgrade to `4.18.5`.\n- On the 4.22.x LTS stream, upgrade to `4.22.1`.\n- Until upgrading, terminate the authorization code flow in a component that performs its own state binding instead of relying on the Camel callback.\n- After upgrading, make sure any proxy keeps the callback query string intact, since a dropped `state` parameter now returns 400.","reach":"internet","title":"Apache Camel OAuth callback lets attackers force victims into their login","impact":"medium","summary":"The Apache Camel OAuth component's authorization callback does not check a state parameter, so an authorization code from any browser can be redeemed in a victim's session. An attacker can thereby silently sign a victim in as the attacker's identity and redirect the victim from a trusted origin to an arbitrary site.","category":"package","nicknames":[],"who_cares":["java","apache-camel","oauth","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Victim silently signed into attacker account; open redirect from trusted origin","analyst_note":"","how_to_check":"- Check the Camel version in use, for example with `mvn dependency:list | grep camel-oauth` or the lockfile, and compare it with the affected ranges: `4.11.0` to before `4.18.5`, and `4.19.0` to before `4.22.1`.\n- Confirm whether the application exposes an OAuth authorization code callback route built on the Camel OAuth component.","needs_analyst":false,"not_affected_if":["no-camel-oauth-callback","patched-version"],"who_is_affected":"Applications that use the Apache Camel OAuth component to handle an authorization code callback are exposed, in the affected version ranges. Deployments that do not use the Camel OAuth component or its callback route are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":3762,"output_tokens":698,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84178':14A,17A '4.11.0':100C '4.18':252C '4.18.5':102C,260C '4.19.0':104C '4.22':264C '4.22.1':106C,272C '4.23.0':244C '400':304C,354C 'absent':294C 'account':193C 'action':178C 'affect':96C 'allow':200C 'also':199C 'apach':1A,19B,28B,90C,97C,242C 'apache-camel':18B 'arbitrari':80B 'associ':149C 'attack':6A,57B,67B,174C,191C 'authent':204C 'author':33B,43B,108C,121C,135C,224C,274C,314C 'begin':351C 'behind':339C 'bind':117C,325C 'bound':281C 'browser':47B,140C 'callback':4A,34B,110C,129C,147C,197C,287C,332C,347C 'camel':2A,20B,29B,91C,98C,243C,331C 'cannot':309C 'carri':113C 'check':37B,220C 'code':44B,109C,136C,225C,315C 'compon':31B,93C,319C 'control':175C 'could':141C 'cross':83C,159C 'cross-sit':82C,158C 'csrf':87C 'cve':12A,15A 'data':184C 'deploy':307C,338C 'drop':343C 'fix':246C 'flow':126C,316C 'forc':7A 'forgeri':86C,162C 'give':210C 'handl':198C 'host':26B 'ident':69B,172C,238C 'immedi':311C 'influenc':209C 'interact':235C 'issu':95C,248C,277C 'java':21B 'land':188C 'let':5A 'login':11A,157C 'lts':254C,266C 'match':298C 'must':360C 'note':333C 'oauth':3A,22B,30B,92C 'obtain':137C 'one':133C 'open':212C 'origin':77B,217C 'packag':23B 'paramet':40B,116C,359C 'path':230C 'perform':182C,321C 'post':203C 'post-authent':202C 'present':153C 'provid':239C 'proxi':341C 'queri':348C 'rather':326C 'reachabl':232C 'redeem':50B,144C,227C 'redirect':71B,205C,213C 'reject':288C 'releas':255C,267C 'reli':328C 'request':85C,122C,161C,275C,290C 'respons':305C,355C 'rewrit':345C 'round':363C 'rout':301C 'run':221C 'see':353C 'self':25B 'self-host':24B 'session':55B,152C,284C 'sign':61B,168C 'silent':60B,167C 'site':81B,84C,160C 'start':124C 'state':39B,115C,219C,279C,292C,324C,358C 'stop':299C 'stream':256C,268C 'string':349C 'submit':187C 'surviv':361C 'target':206C 'termin':312C 'therebi':59B 'therefor':142C 'trip':364C 'trust':76B,216C 'unvalid':196C 'upgrad':240C,258C,270C,310C,336C 'user':249C,261C 'valu':280C 'verifi':132C 'victim':8A,53B,63B,73B,164C,180C 'vulner':88C 'whichev':151C 'whose':291C 'without':233C 'x':253C,265C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Apache Camel OAuth component to handle an authorization code callback are exposed, in the affected version ranges. Deployments that do not use the Camel OAuth component or its callback route are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84178","severity":null,"published_at":"2026-10-19T11:17:21+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}