A Kafka broker that uses the default JWT validator will silently bypass signature verification if the JWKS endpoint URL is not configured. The system falls back to a client validator that accepts any structurally valid token, including those with "alg":"none", and does not check issuer or algorithm. An unauthenticated remote attacker can craft a token asserting any principal, even configured superusers, and gain full administrative access to the Kafka cluster.

Apache Software Foundation’s Apache Kafka is the affected product. All Kafka releases prior to version 4.2.2 (including 4.1.x and 4.2.1) that rely on the default validator and lack a configured jwks.endpoint.url are vulnerable. Brokers that explicitly set the jwks.endpoint.url, provide a custom verification key resolver, or run a version that throws a configuration exception (4.2.2, 4.3.1, 4.4.0) are not affected.

The vulnerability is not listed in KEV and EPSS data is unavailable, but no CVSS score is provided. The potential impact is severe because any remote entity that can reach a broker listener can forge a token and impersonate any cluster user, including superusers. The attack vector is inferred to be network‑based, requiring only the ability to reach the Kafka broker, and can be executed by an unauthenticated attacker without local privileges.