{"id":"CVE-2026-84178","revision":null,"records":[{"revision":"eb7b816999874437966349a6199cc53c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-84178","aliases":[],"title":"Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow","description":"Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.\n\n\n\nThis issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did not verify one. An authorization code obtained in any browser could therefore be redeemed at the callback and associated with whichever session presented it, which is login cross-site request forgery: a victim can be silently signed in as an identity the attacker controls, so that actions the victim then performs, and data they then submit, land in the attacker's account. The same unvalidated callback handling also allowed the post-authentication redirect target to be influenced, giving an open redirect from a trusted origin. The state check runs before the authorization code is redeemed, so these paths are reachable without any interaction with the identity provider.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The authorization request now issues a state value bound to the session, and the callback rejects a request whose state is absent or does not match, stopping the route with a 400 response. For deployments that cannot upgrade immediately, terminate the authorization code flow in a component that performs its own state binding rather than relying on the Camel callback. Note that after upgrading, a deployment behind a proxy that drops or rewrites the callback query string will begin to see 400 responses, because the state parameter must survive the round trip.","state":0,"publishedAt":"2026-10-19T10:30:42.299+00:00","modifiedAt":"2026-10-19T18:40:29.279+00:00","affected":[{"ecosystem":"https://repo.maven.apache.org/maven2","name":"org.apache.camel:camel-oauth","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"product\": \"Apache Camel\",\n                    \"collectionURL\": \"https://repo.maven.apache.org/maven2\",\n                    \"packageName\": \"org.apache.camel:camel-oauth\",\n                    \"packageURL\": \"pkg:maven/org.apache.camel/camel-oauth\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.11.0\",\n                            \"lessThan\": \"4.18.5\",\n                            \"versionType\": \"maven\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.19.0\",\n                            \"lessThan\": \"4.22.1\",\n                            \"versionType\": \"maven\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://camel.apache.org/security/CVE-2026-84178.html","https://issues.apache.org/jira/browse/CAMEL-24437","https://github.com/apache/camel/pull/25821","https://github.com/apache/camel/pull/25944","https://github.com/apache/camel/pull/25946"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84178","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-84178","identifiers":["CVE-2026-84178"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T21:02:31.8931850+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T21:02:31.893185+00:00","lastSuccessAt":"2026-11-08T21:02:32.2143877+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:32.2146388+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-ea572f75aa62c370f36c9951285f437791ed77e310a361fa98b48744b8a4f391","complete":true,"records":421267,"lastAttemptAt":"2026-11-08T21:02:31.4333443+00:00","lastSuccessAt":"2026-11-08T20:47:19.8933196+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:31.4333443+00:00","snapshotPublishedAt":"2026-11-08T20:26:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-45d47722bca14f09ac26662adb699591","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T21:02:36.7086981+00:00","lastSuccessAt":"2026-11-08T20:47:46.939+00:00","error":null,"lastVerifiedAt":"2026-11-08T20:47:46.939+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T21:02:31.8931850+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T21:02:31.893185+00:00","lastSuccessAt":"2026-11-08T21:02:32.3894193+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:32.38942+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ddc095a411c54633beb68aaff30b70cb","complete":true,"records":13666,"lastAttemptAt":"2026-11-08T21:02:34.4952279+00:00","lastSuccessAt":"2026-11-08T21:02:34.481+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:34.481+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T21:02:31.7841816+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:31.7841816+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T21:02:31.5325642+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:31.5325642+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T21:02:31.8040207+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:31.8040207+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T21:02:31.6506398+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T21:02:31.6506398+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}