← back
CVE-2026-33557criticalCWE-1285CWE-303

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.7%
exploitation probability
0.7%top 49% of all CVEs
observed exploitation
nono source reports it
In short

Apache Kafka's default OAuth authentication doesn't verify JWT tokens properly, allowing attackers to forge tokens and gain unauthorized access to the broker with any username they choose.

Technical detail

The DefaultJwtValidator in Apache Kafka's OAUTHBEARER mechanism fails to validate JWT signatures, issuer claims, and audience restrictions. An unauthenticated attacker can craft arbitrary JWT tokens with spoofed identities and authenticate as any user without cryptographic verification. This bypasses access controls in affected versions (4.1.0, 4.1.1).

Summary generated and translated by AI from the official description.
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Apache Software Foundation · Apache Kafka
References
https://access.redhat.com/security/cve/CVE-2026-33557https://bugzilla.redhat.com/show_bug.cgi?id=2459739https://kafka.apache.org/cve-listhttps://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953hhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.jsonhttp://www.openwall.com/lists/oss-security/2026/04/17/2