---
id: "CVE-2026-84178"
kind: "vulnerability"
aliases: ["CVE-2026-84178"]
title: "Apache Camel OAuth callback lets attackers force victims into their login"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-camel", "java", "oauth", "package", "self-hosted"]
not_affected_if: ["no-camel-oauth-callback", "patched-version"]
published_at: "2026-10-19T11:17:21+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:04:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84178", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Camel OAuth callback lets attackers force victims into their login

The Apache Camel OAuth component's authorization callback does not check a state parameter, so an authorization code from any browser can be redeemed in a victim's session. An attacker can thereby silently sign a victim in as the attacker's identity and redirect the victim from a trusted origin to an arbitrary site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Camel version in use, for example with `mvn dependency:list | grep camel-oauth` or the lockfile, and compare it with the affected ranges: `4.11.0` to before `4.18.5`, and `4.19.0` to before `4.22.1`.
- Confirm whether the application exposes an OAuth authorization code callback route built on the Camel OAuth component.

## Fix

- Upgrade Apache Camel to `4.23.0`.
- On the 4.18.x LTS stream, upgrade to `4.18.5`.
- On the 4.22.x LTS stream, upgrade to `4.22.1`.
- Until upgrading, terminate the authorization code flow in a component that performs its own state binding instead of relying on the Camel callback.
- After upgrading, make sure any proxy keeps the callback query string intact, since a dropped `state` parameter now returns 400.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84178

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.



This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.

The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did not verify one. An authorization code obtained in any browser could therefore be redeemed at the callback and associated with whichever session presented it, which is login cross-site request forgery: a victim can be silently signed in as an identity the attacker controls, so that actions the victim then performs, and data they then submit, land in the attacker's account. The same unvalidated callback handling also allowed the post-authentication redirect target to be influenced, giving an open redirect from a trusted origin. The state check runs before the authorization code is redeemed, so these paths are reachable without any interaction with the identity provider.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The authorization request now issues a state value bound to the session, and the callback rejects a request whose state is absent or does not match, stopping the route with a 400 response. For deployments that cannot upgrade immediately, terminate the authorization code flow in a component that performs its own state binding rather than relying on the Camel callback. Note that after upgrading, a deployment behind a proxy that drops or rewrites the callback query string will begin to see 400 responses, because the state parameter must survive the round trip.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_