## https://sploitus.com/exploit?id=546C23BA-D020-5D9A-85E5-90689CA3CF00
# CVE-2026-66908 — camel-platform-http-main JWT `iss`/`aud` not validated
Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the **camel-main embedded HTTP
server** builds its JWT authenticator from a keystore alone when neither `jwtIssuer` nor `jwtAudience` is
configured, so inbound tokens are checked for **signature and expiry only** — the `iss` and `aud` claims are never
validated.
| Runtime | Directory | Stack |
|---------|-----------|-------|
| **Camel Main** (standalone) | [`camel-main/`](camel-main/) | camel-main **4.21.0** + camel-platform-http-main |
> **Why camel-main and not Camel Spring Boot / Camel Quarkus?** The vulnerable class,
> `JWTAuthenticationConfigurer`, lives in `camel-platform-http-main` — the **camel-main embedded HTTP server**
> (`MainHttpServer`), used by standalone camel-main applications and `camel-jbang`. That server is *not* the
> Camel Spring Boot platform-http integration (servlet-based) nor the Camel Quarkus one (Quarkus/Vert.x HTTP with
> its own security), so there is no faithful Spring Boot or Quarkus reproducer for this specific defect. This
> repository therefore provides a standalone **camel-main** reproducer, which is the accurate host for the bug.
```bash
cd camel-main
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit
docker compose down
```
Expected output on an affected build:
```
[1] GET /protected with NO token -> HTTP 401 (auth is enforced)
[2] GET /protected with token iss=https://attacker.example aud=some-unrelated-service -> HTTP 200 (ACCEPTED — iss/aud NOT validated)
[3] GET /protected with the same token but EXPIRED -> HTTP 401 (expiry IS checked)
>>> PROVEN: ... the iss and aud claims were never checked ... : true
```
## Vulnerability Summary
| Property | Value |
|----------|-------|
| **Component** | `camel-platform-http-main` (the camel-main embedded HTTP server) |
| **CWE** | CWE-287 (Improper Authentication) / CWE-1259 (missing validation of security claims) |
| **Attack vector** | A JWT signed by the trusted key (e.g. a shared JWKS) but issued for a different issuer/audience |
| **Impact** | Any unexpired token from any party sharing the signing key is accepted — the deployment enforces less than the operator believes |
| **Affected Versions** | From 4.8.0 before 4.22.0 |
| **Fixed Versions** | 4.22.0 |
| **JIRA** | [CAMEL-24281](https://issues.apache.org/jira/browse/CAMEL-24281) |
| **Credit** | n0mi1k |
Advisory: https://camel.apache.org/security/CVE-2026-66908.html
## The fix
From 4.22.0 the server **refuses to start** when a JWT keystore is configured but neither `jwtIssuer` nor
`jwtAudience` is set, naming the missing properties. An operator who genuinely wants signature-and-expiry-only
validation must opt in explicitly with `camel.server.jwtAllowMissingIssuerAndAudience=true` (fail-closed by
default):
```java
// fixed (JWTAuthenticationConfigurer.assertIssuerOrAudienceConfigured)
if (ObjectHelper.isEmpty(audience) && ObjectHelper.isEmpty(issuer)) {
throw new IllegalArgumentException(
"JWT authentication requires camel.server.jwtIssuer or camel.server.jwtAudience to be configured, ...");
}
```
## Disclaimer
This repository is published for educational and defensive purposes: to help Apache Camel users understand the
vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The tokens are minted
locally against a throwaway demo keystore bundled in the project. Do not use this material against systems you do
not own or operate.