Authentication policy libraries often become simpler to configure by making optional checks optional at runtime. Apache Camel's KeycloakSecurityPolicy made token verification depend on role and permission checks. In the default basic setup, neither check ran.
CVE-2026-53913 describes the resulting fail-open authentication bypass in camel-keycloak.
The order of checks
KeycloakSecurityProcessor.beforeProcess() first rejects a request with no access token. If requiredRoles is non-empty, it validates roles. If requiredPermissions is non-empty, it validates permissions.
The detailed signature, issuer and expiry verification happens inside those role and permission checks. The policy defaults both lists to empty, which the advisory identifies as the documented basic setup. A request with any non-null bearer value therefore passes the presence check and reaches the route without cryptographic verification.
The value can be an arbitrary string or a forged, unsigned JWT. No request to Keycloak is required. The token is read from the inbound request header because allowTokenFromHeader defaults to true.
Why this affects more than authentication
A protected Camel route usually performs server-side work. If the route forwards to a producer capable of code execution, an unauthenticated attacker may reach that capability. The advisory states that consequence, but operators should evaluate the actual route chain rather than assume every deployment exposes command execution.
The issue is independent of CVE-2026-23552. That earlier issue concerned issuer validation inside the verification routine. CVE-2026-53913 is upstream of that routine because the routine was not called at all in the default configuration.
Affected and fixed versions
The Camel security advisory lists affected ranges as 4.15.0 before 4.18.3 and 4.19.0 before 4.21.0. Fixed versions are 4.18.3 and 4.21.0. The component was introduced in 4.15.0, so the 4.14.x line does not include it.
Mitigation before upgrade
Configure a non-empty requiredRoles or requiredPermissions on every KeycloakSecurityPolicy. This forces the token-verification path to run. Set allowTokenFromHeader to false when the request header is not an expected token source. Add authentication at the framework layer ahead of the Camel policy where possible.
The workaround should be tested with invalid signatures, expired tokens and tokens from the wrong issuer. A policy with a role configured is not automatically safe if the role check itself can be skipped by a malformed token.
Inventory and review
Search Camel route definitions for KeycloakSecurityPolicy and record whether role or permission requirements are present. Identify routes that can invoke file, process, database or messaging producers with powerful credentials.
Review access logs for bearer values that were never issued by the identity provider, requests that reached protected routes without a corresponding Keycloak event, and unusual producer activity. The application may record the attacker's chosen username or role, so authentication logs should be compared with IdP issuance records.