Search: CVE-2026-110952

Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator verify JWT signatures but do not enforce issuer and audience claim checks by default. This can allow tokens from different issuers or without audience claims to authenticate if the JWKS endpoint serves keys for multiple issuers. From version 4.4.0, Kafka requires explicit configuration of issuer and audience checks or allows opting out. Versions 3.1.0 through before 4.4.0 are affected if these settings are not configured.