# Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

Apache Camel KeycloakSecurityPolicy's default empty requiredRoles/requiredPermissions skips token verification, so any non-null Bearer value reaches protected routes unauthenticated.

- Payout: Research
- Severity: critical
- Program: Apache Camel
- Found by (vendor credit): Lidor Ben Shitrit from Novee Security
- Found by: oscerd
- Disclosed: 2026-07-06
- CVE: CVE-2026-53913
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-qvc3-6q9x-95pj
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-qvc3-6q9x-95pj
- Tags: area:oss domain:oss impact:internal-access impact:rce kind:research platform:ghsa sev:critical tech:java technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** camel-keycloak KeycloakSecurityPolicy route guard
**Root cause:** KeycloakSecurityProcessor.beforeProcess() only performs cryptographic token verification inside the role and permission checks, which are skipped when requiredRoles and requiredPermissions are empty (the documented default). Only a token-presence check remains.
**Steps:**
1. Configure a Camel route with KeycloakSecurityPolicy using defaults (empty requiredRoles and requiredPermissions).
2. Send a request to the protected route with header `Authorization: Bearer <arbitrary string>` (or a forged unsigned JWT).
3. Observe the policy accepts the request: no signature, issuer or expiry check, no call to Keycloak, request reaches the protected route.
**How found:** Code reading of KeycloakSecurityProcessor.beforeProcess(): noticed the three sequential checks and that signature/issuer/expiry verification lives only inside the role and permission branches, which are unreachable under the documented default empty config.
**Exploitation:** Attacker sends any non-null Bearer value in the Authorization header (allowTokenFromHeader defaults true) to a route guarded by the default policy; the request passes unauthenticated. Where the route forwards to a code-execution-capable producer, this yields unauthenticated RCE.
**Escalation:** Bypass of authentication on a route that forwards to a code-execution-capable producer escalates to unauthenticated remote code execution.
**Insight:** When an auth guard splits presence-check from crypto-verification and gates verification behind optional config (roles/permissions), test the documented default config with a garbage token — the verification path may never execute.