The vulnerability is caused by the default JWT validator in Kafka brokers, which accepts any JWT token without verifying its signature, issuer, or audience. Because of this missing validation, an attacker can produce a forged token containing any desired username, and the broker will treat the token as legitimate. This flaw, a CWE-1285 Missing Credentials Validation weakness, can lead to unauthorized access to Kafka resources and impersonation of legitimate users.

Apache Software Foundation's Apache Kafka versions 4.1.0 and 4.1.1 are affected when the broker property sasl.oauthbearer.jwt.validator.class is set to its default value. The issue is resolved in Kafka 4.1.2 and later, including 4.2.0 and newer releases.

The CVSS score is 9.1, and the EPSS score is unavailable, but the vulnerability is active for all brokers running the vulnerable default configuration. An attacker who can connect to the broker using the OAUTHBEARER mechanism can simply send a malicious JWT to gain full access. The vulnerability does not require local privileges and can be triggered over the network, making it a high‑risk security concern. It is not listed in the CISA KEV catalog.