A vulnerability in the Kroxylicious ACL authorizer's prefix-matching logic can cause authorization rules to be incorrectly applied or bypassed. This flaw may allow an authenticated Kafka client to access resources, such as reading a topic, that should be denied based on the ACL configuration.