{"vulnerability": "CVE-2026-66908", "sightings": [{"uuid": "2e05b456-6be3-47d3-afab-013a397b14fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66908", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/b4ptz5cw32ay2", "content": "CVE-2026-66908: Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted", "creation_timestamp": "2026-08-24T18:22:28.901151Z"}, {"uuid": "185df1c0-3f1d-4430-a986-9ce633469c3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66908", "type": "seen", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-24T21:00:03.994222Z"}, {"uuid": "2f41ec40-e188-4f36-935a-1c680d83083a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66908", "type": "published-proof-of-concept", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-25T00:00:10.097683Z"}]}