CVE-2026-23552

Back Cve

CVE-2026-23552

Cve • February 23, 2026

Share: View original

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-23552: Critical Vulnerability in Keycloak Component CVE-2026-23552 identifies a critical vulnerability in the KeycloakSecurityPolicy of the Apache Camel Keycloak component. This flaw allows a Cross-Realm Token Acceptance Bypass, where JWT tokens from one Keycloak realm are accepted by a policy configured for a different realm, compromising tenant isolation. Affected users are advised to upgrade to Apache Camel version 4.18.0 to mitigate this issue. 2 sources 62

Extracted Entities

CVEs (1)

Platforms (2)

Apache Keycloak