The vulnerability in Apache Kafka arises from the default broker property sasl.oauthbearer.jwt.validator.class being set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This validator does not validate the JWT token's signature, issuer, or audience, effectively accepting any token presented. An attacker can exploit this by generating a JWT token from any issuer with the preferred_username claim set to any user, and the broker will accept it as valid. Kafka versions 4.1.2, 4.2.0, and later address this issue by implementing proper JWT validation. Users of Kafka 4.1.0 and 4.1.1 are advised to explicitly set the validator class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator to mitigate the vulnerability.

This vulnerability allows an unauthenticated attacker to impersonate any user by presenting a crafted JWT token that bypasses signature and issuer validation. This can lead to unauthorized access with the privileges of the impersonated user, potentially compromising confidentiality and integrity of Kafka broker operations. The CVSS score of 9.1 reflects the critical impact with network attack vector, no required privileges or user interaction, and high confidentiality and integrity impact.

Users running Apache Kafka versions 4.1.0 or 4.1.1 should explicitly configure the broker property sasl.oauthbearer.jwt.validator.class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator to enforce proper JWT validation. Upgrading to Apache Kafka version 4.1.2, 4.2.0, or later is recommended as these versions include the fix that correctly validates JWT tokens by default. Patch status is not explicitly stated in the vendor advisory, but the fix is included starting from version 4.1.2. No other mitigation is indicated by the vendor advisory.