Timing Attack Vulnerability for Apache Kafka Connect and Clients

Apache Kafka uses an insecure method to compare passwords and keys, which allows attackers to guess credentials faster by measuring response times. This timing-based weakness makes brute force attacks more practical.

The vulnerability exists in password/key validation logic that uses Arrays.equals, which is not constant-time and leaks information through execution duration variations. An attacker can exploit this timing side-channel to differentiate correct from incorrect credential attempts and accelerate brute force attacks against Kafka Connect and client authentication mechanisms.