oscerd/cve-2026-80312Runnable proof-of-concept for CVE-2026-80312, a fail-open OAuth guard in Apache Camel camel-oauth, with affected and fixed Spring Boot and Quarkus reproducers.
Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-oauth processors that guard
a route did not stop the exchange when authentication could not be completed. Where a failure to establish an
authenticated session should have terminated routing and returned an error, the processor set a response code but
returned control to the route — so the request continued to the protected endpoint as though authentication had
succeeded. The result is a fail-open authentication guard: an unauthenticated caller reaches whatever the route
does next, on the ordinary request path, with no special configuration.
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.5.13 + camel-oauth 4.22.0 (affected; fixed 4.22.1), HTTP via camel-undertow |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.39.0 + camel-quarkus-oauth 3.39.0 (Camel 4.22.0, affected; fixed control 3.40.0 / Camel 4.22.1), HTTP via camel-quarkus-platform-http |
Both modules demonstrate the affected and the fixed behaviour. (The Spring Boot module uses camel-undertow as
the HTTP transport — the guard is transport-agnostic, and camel-platform-http-starter 4.22.0 is built against a
different Spring Boot line than 3.5.x.)
A route exposes /protected, guarded by OAuthBearerTokenProcessor; only an authenticated request should reach the
protected steps that follow. The attacker sends GET /protected with no Authorization header.
exchange.setRouteStop(true), so the route
fell through to the protected steps → HTTP 200 and the protected body.rejectUnauthorized(...), which replies 401 and stops the route → the protected
steps never run.cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
Expected output on the affected build:
Sent: GET /protected (NO Authorization header)
Response status: 200
Response body : PROTECTED-DATA: reached the protected endpoint WITHOUT authenticating
>>> PROVEN: the OAuth guard failed open ...
On the fixed build: Response status: 401, body Authorization header, protected steps never ran.
| Property | Value |
|---|---|
| Component | camel-oauth (route-guard processors, e.g. OAuthBearerTokenProcessor) |
| CWE | CWE-287 (Improper Authentication) |
| Severity | HIGH |
| Attack vector | An ordinary request to an OAuth-protected route where authentication cannot be completed (here: no Authorization header) |
| Impact | Unauthenticated access to the protected endpoint (authentication bypass) |
| Affected Versions | From 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| Fixed Versions | 4.18.5, 4.22.1, 4.23.0 |
| JIRA | CAMEL-24411 |
| Credit | Claude Security Scan Tool |
Advisory: https://camel.apache.org/security/CVE-2026-80312.html
The guard processors now call rejectUnauthorized(...) / reject(...) on every path where authentication cannot be
completed, which sets the HTTP status (401) and calls exchange.setRouteStop(true) so no subsequent step runs
for a request the processor did not authenticate. "Absence of credentials must be rejected at least as strongly as
invalid credentials."
Place an explicit authorization check after the guard, or ensure the route terminates when the
CamelOAuthUserProfile exchange property is absent, until you can upgrade.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material against systems you do not own or operate.