CVE-2026-46455 — camel-keycloak Missing IS_ACTIVE Check (Expired Tokens Accepted)

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.18.3 / 4.21.0), and both demonstrate the identical defect: KeycloakSecurityHelper.parseAndVerifyAccessToken verifies the token's signature, subject and issuer, but omits Keycloak's TokenVerifier.IS_ACTIVE check — so exp / nbf are never enforced and an expired token is accepted. Any leaked or captured token remains usable indefinitely (CWE-613 + CWE-287).

Each PoC mints a correctly-signed access token whose exp is 30 minutes in the past and runs it through both the vulnerable helper and a verifier with IS_ACTIVE added (what the fix does), proving the helper accepts what IS_ACTIVE rejects. No Keycloak server is required — the token is signed with an RSA key generated in-process.

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-46455.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.