A critical authentication bypass in the Apache Camel HTTP Main component allows attackers to present invalid JWT tokens that are improperly validated, posing a significant risk to system integrity.

The vulnerability exists in the camel-main embedded HTTP server, where JWT tokens are only checked for signature and expiry due to a failure to validate issuer (iss) and audience (aud) claims. This flaw allows any unexpired token, regardless of its intended audience or issuer, to be accepted as valid by the system, effectively bypassing intended authentication controls.

The ability for an attacker to bypass authentication checks using arbitrary unexpired tokens can lead to unauthorized access to both application and management endpoints. Given the CVSS score of 7.5, this high-severity vulnerability could facilitate unauthorized configuration changes or data manipulation within the Camel environment. The silent nature of the failure means security teams may be unaware that their authentication controls are insufficient, leading to a false sense of security.

Immediate Action: Upgrade Apache Camel to version 4.22.0 or later to ensure that JWT issuer and audience claims are correctly enforced during authentication.

Proactive Monitoring: Review application and management server logs for unusual authentication patterns or tokens that might originate from unexpected issuers.

Compensating Controls: If an immediate upgrade is not feasible, restrict access to the affected HTTP endpoints at the network level using a firewall or reverse proxy to limit exposure to trusted sources.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

This vulnerability represents a significant failure in the security architecture of the Apache Camel HTTP Main component. Organizations should prioritize patching to version 4.22.0 immediately to restore proper JWT validation and prevent unauthorized access. Failure to address this flaw leaves administrative and application endpoints exposed to actors capable of presenting validly signed, yet unauthorized, tokens.