CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound tokens are checked for signature and expiry only — the iss and aud claims are never validated.

Why camel-main and not Camel Spring Boot / Camel Quarkus? The vulnerable class, JWTAuthenticationConfigurer, lives in camel-platform-http-main — the camel-main embedded HTTP server (MainHttpServer), used by standalone camel-main applications and camel-jbang. That server is not the Camel Spring Boot platform-http integration (servlet-based) nor the Camel Quarkus one (Quarkus/Vert.x HTTP with its own security), so there is no faithful Spring Boot or Quarkus reproducer for this specific defect. This repository therefore provides a standalone camel-main reproducer, which is the accurate host for the bug.

cd camel-main
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit
docker compose down

Expected output on an affected build:

[1] GET /protected with NO token                       -> HTTP 401  (auth is enforced)
[2] GET /protected with token iss=https://attacker.example aud=some-unrelated-service  -> HTTP 200  (ACCEPTED — iss/aud NOT validated)
[3] GET /protected with the same token but EXPIRED     -> HTTP 401  (expiry IS checked)
>>> PROVEN: ... the iss and aud claims were never checked ... : true

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-66908.html

The fix

From 4.22.0 the server refuses to start when a JWT keystore is configured but neither jwtIssuer nor jwtAudience is set, naming the missing properties. An operator who genuinely wants signature-and-expiry-only validation must opt in explicitly with camel.server.jwtAllowMissingIssuerAndAudience=true (fail-closed by default):

// fixed (JWTAuthenticationConfigurer.assertIssuerOrAudienceConfigured)
if (ObjectHelper.isEmpty(audience) && ObjectHelper.isEmpty(issuer)) {
    throw new IllegalArgumentException(
        "JWT authentication requires camel.server.jwtIssuer or camel.server.jwtAudience to be configured, ...");
}

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The tokens are minted locally against a throwaway demo keystore bundled in the project. Do not use this material against systems you do not own or operate.