The vulnerability arises from a hard‑coded setting in the KrakenD instance that disables TLS certificate verification when retrieving the JSON Web Key Set used for token validation. Because this setting cannot be overridden in the dev version, an attacker who can intercept communication between KrakenD and the JWKS endpoint can supply a malicious key set, allowing the system to accept forged bearer tokens. This effectively bypasses authentication and can grant the attacker unauthorized access to protected resources.

This flaw affects the Eclipse aeriOS API Gateway component before its first official release. All deployments using the development snapshot of Eclipse aeriOS that include the default KrakenD configuration are susceptible, regardless of the target environment. No specific product version is listed, and the issue was present only in the current development build.

The CVSS score of 9 indicates critical severity. EPSS information is not available, but the flaw is trivial to exploit once network access is available—the attacker only needs to intercept the JWKS retrieval. The vulnerability is not currently listed in the CISA KEV catalog, but the ease of exploitation and high impact warrant immediate consideration. The attack vector is likely network-based or local if the attacker can compromise the underlying host. The fix introduced a configurable flag (krakend.config.disableJwkSecurity) that defaults to false, re-enabling TLS verification.