Exposure is mainly realizable where the JWKS endpoint provides signing keys for multiple issuers, such as a multi-tenant identity provider, an aggregated or shared JWKS endpoint, or shared signing keys. Brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator are relevant.
The attacker needs a JWT with a signature accepted by the broker's configured JWKS. If issuer validation is unset, a token from another issuer can be accepted when it carries the expected audience; if audience validation is unset, a validly signed token without an aud claim can be accepted.
Yes, both sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience default to unset. The issuer is not checked unless the former is configured, and an aud claim is not required unless the latter is configured.
Configure sasl.oauthbearer.expected.issuer to require the intended token issuer and sasl.oauthbearer.expected.audience to require the intended audience. Review the JWKS source as well, particularly whether it serves keys for multiple issuers or uses shared signing keys.
Review Kafka brokers running versions from 3.1.0 before 4.4.0 that use SASL/OAUTHBEARER with the bundled JWKS-backed validator. Check whether either expected issuer or expected audience setting is unset, and whether the configured JWKS serves more than one issuer.