Affected deployments use SASL/OAUTHBEARER with DefaultJwtValidator and have no sasl.oauthbearer.jwks.endpoint.url configured and no custom verification key resolver. The affected release ranges are Kafka 4.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0.
The JWKS endpoint URL is unset by default. However, exposure requires that the broker is configured to perform SASL/OAUTHBEARER validation with DefaultJwtValidator while no custom verification key resolver is supplied.
An attacker only needs network reachability to the affected listener. They can submit a structurally valid forged JWT, including an alg:none token, and assert any principal, including configured superusers.
Configure sasl.oauthbearer.jwks.endpoint.url so that DefaultJwtValidator verifies JWT signatures. Alternatively, supply a custom verification key resolver rather than leaving both the JWKS endpoint URL and resolver unset.
Review brokers using SASL/OAUTHBEARER and DefaultJwtValidator, then check whether sasl.oauthbearer.jwks.endpoint.url is unset and no custom verification key resolver is configured. In that state, the broker starts without a warning or error, so startup logs alone may not reveal the issue.