CVE-2026-80312

{
  "etk_id": "ETK-2026-2048",
  "cve_id": "CVE-2026-80312",
  "display_id": "CVE-2026-80312",
  "ghsa_id": "GHSA-5m9r-c7qx-c2h6",
  "euvd_id": "EUVD-2026-104215",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Fail-open authentication bypass in Apache Camel OAuth",
  "summary": "Apache Camel OAuth is affected in versions 4.11.0 through before 4.18.5 and 4.19.0 through before 4.22.1. An unauthenticated requester may reach downstream route handling when OAuth session establishment fails, if the route relies on the affected OAuth processor to terminate failed authentication.",
  "mitigation": "Upgrade to Apache Camel 4.23.0, or to 4.18.5 or 4.22.1 on the corresponding LTS branch. Until upgraded, add an explicit authorization check after the OAuth processor and ensure the route stops when authentication fails.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Camel",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.11.0, < 4.18.5",
        ">= 4.19.0, < 4.22.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.18.5",
        "4.22.1"
      ],
      "package_name": "org.apache.camel:camel-oauth",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
  "epss_score": 0.0051,
  "epss_percentile": 0.4258,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.222774783333334,
  "t0_at": "2026-10-19T10:27:34.015000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-19T11:15:19.247927+00:00",
      "days": 0.03316241813657408,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T10:27:34.015000+00:00",
      "url": "https://github.com/oscerd/CVE-2026-80312"
    },
    "trigger_signal": {
      "at": "2026-10-19T10:27:34.015000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T10:27:34.015000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80312"
    }
  }
}