A vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER with the default validator and no JWKS endpoint URL set allows acceptance of any structurally valid JWT without signature verification. This enables unauthenticated remote attackers to forge tokens asserting any principal, including superusers, gaining full cluster access. The issue affects brokers that enable SASL/OAUTHBEARER validation without configuring a JWKS endpoint URL or a custom signature-verifying validator. From Apache Kafka versions 4.2.2, 4.3.1, and 4.4.0, brokers fail to start if misconfigured, preventing insecure operation.