CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
// summary
CVE-2026-94386 affects Apache Camel OAuth component versions 4.19.0 through 4.22.1, where a token cache may reuse credentials across scopes.
// from the source
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3.1: 4.8 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected versions: - Apache Camel (org.apache.camel:camel-oauth) 4.19.0 before 4.22.2 Description: Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on...