Authentication bypass via thread-bound subject reuse

Authentication bypass in Apache Camel's Shiro processor allows remote attackers to enter protected routes via matching usernames. ShiroSecurityProcessor.authenticateUser() skips login() when the incoming username matches an authenticated thread-bound subject, leaving the incoming password unchecked. Exploitation requires a reachable protected route and reuse of a thread retaining that subject, notably with alwaysReauthenticate=false; default per-exchange logout masks the bypass, and access remains bounded by the inherited principal's permissions.