Threats tagged 'ghsa-r6jr-f97r-9cc7'

A vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator allows tokens with valid signatures but missing or incorrect issuer (iss) and audience (aud) claims to be accepted by default. This occurs because the issuer and audience checks are only enforced if explicitly configured. This can lead to acceptance of tokens minted by different issuers or lacking audience claims, potentially allowing unauthorized authentication.