=== EVIDENCE: Kafka SASL/OAUTHBEARER expired JWT replay === Date (UTC): 2026-07-11T04:12:21Z Vulnerable version: Kafka 4.1.0 Fixed version: Kafka 4.1.2 Fix commit: 01d8e7db8d08dbd538892b409457ea6bfcc2a422 === Summary JSON === { "confirmed": true, "vulnerable_expired_accepted": true, "fixed_expired_rejected": true, "vulnerable_valid_accepted": true, "fixed_valid_accepted": true, "expired_claims": { "sub": "replayed-user", "preferred_username": "replayed-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783735929, "exp": 1783739529, "scope": "kafka-cluster" }, "expired_replay_time": 1783743133 } === Vulnerable expired raw response === { "label": "vulnerable_expired", "host": "127.0.0.1", "port": 58957, "replay_time": 1783743133, "jwt_claims": { "sub": "replayed-user", "preferred_username": "replayed-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783735929, "exp": 1783739529, "scope": "kafka-cluster" }, "jwt_expired_at_replay": true, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "0000000200000000000000000000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } === Fixed expired raw response === { "label": "fixed_expired", "host": "127.0.0.1", "port": 47437, "replay_time": 1783743139, "jwt_claims": { "sub": "replayed-user", "preferred_username": "replayed-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783735929, "exp": 1783739529, "scope": "kafka-cluster" }, "jwt_expired_at_replay": true, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } === Vulnerable valid control === { "label": "vulnerable_valid", "host": "127.0.0.1", "port": 58957, "replay_time": 1783743133, "jwt_claims": { "sub": "replayed-user", "preferred_username": "replayed-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783735929, "exp": 1783746729, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036ddc4", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595716 } } === Fixed valid control === { "label": "fixed_valid", "host": "127.0.0.1", "port": 47437, "replay_time": 1783743139, "jwt_claims": { "sub": "replayed-user", "preferred_username": "replayed-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783735929, "exp": 1783746729, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036c5c3", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3589571 } } === Fixed broker expiration rejection excerpts === [2026-07-11 04:12:19,491] WARN Could not validate the access token: JWT (claims->{"sub":"replayed-user","preferred_username":"replayed-user","iss":"https://mock-idp.example.com","aud":"kafka-broker","iat":1783735929,"exp":1783739529,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[1] The JWT is no longer valid - the evaluation time NumericDate{1783743139 -> Jul 11, 2026, 4:12:19 AM UTC} is on or after the Expiration Time (exp=NumericDate{1783739529 -> Jul 11, 2026, 3:12:09 AM UTC}) claim value (even when providing 30 seconds of leeway to account for clock skew).] (org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler) org.apache.kafka.common.security.oauthbearer.JwtValidatorException: Could not validate the access token: JWT (claims->{"sub":"replayed-user","preferred_username":"replayed-user","iss":"https://mock-idp.example.com","aud":"kafka-broker","iat":1783735929,"exp":1783739529,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[1] The JWT is no longer valid - the evaluation time NumericDate{1783743139 -> Jul 11, 2026, 4:12:19 AM UTC} is on or after the Expiration Time (exp=NumericDate{1783739529 -> Jul 11, 2026, 3:12:09 AM UTC}) claim value (even when providing 30 seconds of leeway to account for clock skew).] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:159) Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT (claims->{"sub":"replayed-user","preferred_username":"replayed-user","iss":"https://mock-idp.example.com","aud":"kafka-broker","iat":1783735929,"exp":1783739529,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[1] The JWT is no longer valid - the evaluation time NumericDate{1783743139 -> Jul 11, 2026, 4:12:19 AM UTC} is on or after the Expiration Time (exp=NumericDate{1783739529 -> Jul 11, 2026, 3:12:09 AM UTC}) claim value (even when providing 30 seconds of leeway to account for clock skew).] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:157) [2026-07-11 04:12:19,492] INFO [SocketServer listenerType=BROKER, nodeId=0] Failed authentication with /127.0.0.1 (channelId=127.0.0.1:47437-127.0.0.1:41720-2-0) ({"status":"invalid_token"}) (org.apache.kafka.common.network.Selector) === Vulnerable broker class/path evidence excerpts === 11: new #41 // class org/apache/kafka/common/security/oauthbearer/BrokerJwtValidator 25: invokespecial #49 // Method org/apache/kafka/common/security/oauthbearer/BrokerJwtValidator."":(Lorg/apache/kafka/common/security/oauthbearer/internals/secured/CloseableVerificationKeyResolver;)V 35: new #53 // class org/apache/kafka/common/security/oauthbearer/ClientJwtValidator 39: invokespecial #54 // Method org/apache/kafka/common/security/oauthbearer/ClientJwtValidator."":()V