MAVEN · JULY 2026 · EARLY WARNING

Apache Camel Keycloak Component Vulnerability: Expired Tokens Accepted

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: apache-camel-keycloak (maven)
Patched version: 4.21.0

GHSA-MQWC-6QWC-V9GQ

An early warning has been issued for a high severity vulnerability in the Apache Camel Keycloak component. This issue allows expired access tokens to be accepted due to a missing IS_ACTIVE check in the TokenVerifier.

What happened

The Apache Camel Keycloak component reportedly does not verify the validity window of access tokens. This is because the IS_ACTIVE check is missing from the TokenVerifier, which allows expired tokens to be accepted. Versions before 4.18.3 and before 4.21.0 are affected.

This vulnerability was first flagged on 2026-07-06T09:30:28+00:00 and is currently under investigation. It has not been exploited in the wild according to the available data. Users of the affected versions should take immediate action to assess their exposure and apply the recommended patches.

What to do about it

Upgrade to version 4.21.0 or 4.18.3 if you are using the 4.18.x releases stream.
Review your application's use of the Apache Camel Keycloak component to ensure that it is not vulnerable to this issue.
Monitor the primary sources for updates on this vulnerability and any additional patches that may be released.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If apache-camel-keycloak is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using versions before 4.18.3 or before 4.21.0 of the Apache Camel Keycloak component.

What should I do right now?

Upgrade to version 4.21.0 or 4.18.3 if you are on the 4.18.x releases stream. Review your application's use of the affected component and monitor the primary sources for updates.

Is there an official fix available?

Yes, version 4.21.0 is the patched version for this vulnerability.

Sources

[GHSA-mqwc-6qwc-v9gq] Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Join the 0Day waitlist →

← Back to all threats