CVE-2021-22160: Authentication with JWT allows use of “none”-algorithm
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache Pulsar vulnerability?
The vulnerability ID for this Apache Pulsar vulnerability is CVE-2021-22160.
What is the severity of CVE-2021-22160?
CVE-2021-22160 has a severity rating of 9.8 (critical).
What software is affected by CVE-2021-22160?
The Apache Pulsar software version up to 2.7.1 is affected by CVE-2021-22160.
How does CVE-2021-22160 impact Apache Pulsar?
CVE-2021-22160 allows an attacker to connect to Apache Pulsar instances as any user, including admins, if the token's algorithm is set to "none".
Are there any references for CVE-2021-22160?
Yes, you can find references for CVE-2021-22160 at the following links: [Link 1](https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E), [Link 2](https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da@%3Cdev.pulsar.apache.org%3E), [Link 3](https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E).