=== EVIDENCE: Kafka SASL/OAUTHBEARER invalid-claim/signature variant matrix === Date (UTC): 2026-07-11T04:18:26Z Repository: https://github.com/apache/kafka Vulnerable version: Kafka 4.1.0 (13f70256db3c994c590e5d262a7cc50b9e973204) Fixed version: Kafka 4.1.2 (c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c) === Summary JSON === { "alternate_trigger_confirmed_on_vulnerable": true, "bypass_confirmed_on_fixed": false, "valid_controls_ok": true, "vulnerable_variant_accepts": { "wrong_issuer": true, "wrong_audience": true, "tampered_signature": true }, "fixed_variant_rejects": { "wrong_issuer": true, "wrong_audience": true, "tampered_signature": true }, "fixed_variant_accepts": { "wrong_issuer": false, "wrong_audience": false, "tampered_signature": false }, "tested_variants": [ "wrong_issuer", "wrong_audience", "tampered_signature" ], "vulnerable_version": "4.1.0", "fixed_version": "4.1.2", "vulnerable_tag_commit": "13f70256db3c994c590e5d262a7cc50b9e973204", "fixed_tag_commit": "c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c" } === vulnerable valid raw response === { "label": "vulnerable_valid", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036ddec", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595756 } } === vulnerable wrong_issuer raw response === { "label": "vulnerable_wrong_issuer", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://attacker-idp.example.net", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036ddb2", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595698 } } === vulnerable wrong_audience raw response === { "label": "vulnerable_wrong_audience", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "other-service", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036dd7a", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595642 } } === vulnerable tampered_signature raw response === { "label": "vulnerable_tampered_signature", "host": "127.0.0.1", "port": 37029, "replay_time": 1783743497, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036dd43", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3595587 } } === fixed valid raw response === { "label": "fixed_valid", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743503, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": true, "rejected_by_broker": false, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "000000020000000000000000000000000036c4ce", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 3589326 } } === fixed wrong_issuer raw response === { "label": "fixed_wrong_issuer", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743503, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://attacker-idp.example.net", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } === fixed wrong_audience raw response === { "label": "fixed_wrong_audience", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743504, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "other-service", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } === fixed tampered_signature raw response === { "label": "fixed_tampered_signature", "host": "127.0.0.1", "port": 48261, "replay_time": 1783743504, "jwt_claims": { "sub": "variant-user", "preferred_username": "variant-user", "iss": "https://mock-idp.example.com", "aud": "kafka-broker", "iat": 1783743433, "exp": 1783747093, "scope": "kafka-cluster" }, "jwt_expired_at_replay": false, "accepted_by_broker": false, "rejected_by_broker": true, "sasl_handshake_raw_hex": "00000001000000000001000b4f41555448424541524552", "sasl_handshake_correlation_id": 1, "sasl_handshake_error_code": 0, "mechanisms": [ "OAUTHBEARER" ], "sasl_authenticate_first_response": { "raw_hex": "00000002000000000000001a7b22737461747573223a22696e76616c69645f746f6b656e227d0000000000000000", "correlation_id": 2, "error_code": 0, "error_message": "", "auth_bytes_len": 26, "auth_bytes_utf8": "{\"status\":\"invalid_token\"}", "session_lifetime_ms": 0 }, "sasl_authenticate_final_response": { "raw_hex": "00000003003a001a7b22737461747573223a22696e76616c69645f746f6b656e227d000000000000000000000000", "correlation_id": 3, "error_code": 58, "error_message": "{\"status\":\"invalid_token\"}", "auth_bytes_len": 0, "auth_bytes_utf8": "", "session_lifetime_ms": 0 } } === Fixed broker rejection excerpts === sasl.oauthbearer.expected.audience = [kafka-broker] sasl.oauthbearer.expected.issuer = https://mock-idp.example.com sasl.oauthbearer.expected.audience = [kafka-broker] sasl.oauthbearer.expected.issuer = https://mock-idp.example.com sasl.oauthbearer.expected.audience = [kafka-broker] sasl.oauthbearer.expected.issuer = https://mock-idp.example.com [2026-07-11 04:18:23,737] WARN Could not validate the access token: JWT (claims->{"sub":"variant-user","preferred_username":"variant-user","iss":"https://attacker-idp.example.net","aud":"kafka-broker","iat":1783743433,"exp":1783747093,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[12] Issuer (iss) claim value (https://attacker-idp.example.net) doesn't match expected value of https://mock-idp.example.com] (org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler) org.apache.kafka.common.security.oauthbearer.JwtValidatorException: Could not validate the access token: JWT (claims->{"sub":"variant-user","preferred_username":"variant-user","iss":"https://attacker-idp.example.net","aud":"kafka-broker","iat":1783743433,"exp":1783747093,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[12] Issuer (iss) claim value (https://attacker-idp.example.net) doesn't match expected value of https://mock-idp.example.com] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:159) Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT (claims->{"sub":"variant-user","preferred_username":"variant-user","iss":"https://attacker-idp.example.net","aud":"kafka-broker","iat":1783743433,"exp":1783747093,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[12] Issuer (iss) claim value (https://attacker-idp.example.net) doesn't match expected value of https://mock-idp.example.com] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:157) [2026-07-11 04:18:23,738] INFO [SocketServer listenerType=BROKER, nodeId=0] Failed authentication with /127.0.0.1 (channelId=127.0.0.1:48261-127.0.0.1:39504-2-0) ({"status":"invalid_token"}) (org.apache.kafka.common.network.Selector) [2026-07-11 04:18:24,099] WARN Could not validate the access token: JWT (claims->{"sub":"variant-user","preferred_username":"variant-user","iss":"https://mock-idp.example.com","aud":"other-service","iat":1783743433,"exp":1783747093,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[8] Audience (aud) claim [other-service] doesn't contain an acceptable identifier. Expected kafka-broker as an aud value.] (org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler) org.apache.kafka.common.security.oauthbearer.JwtValidatorException: Could not validate the access token: JWT (claims->{"sub":"variant-user","preferred_username":"variant-user","iss":"https://mock-idp.example.com","aud":"other-service","iat":1783743433,"exp":1783747093,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[8] Audience (aud) claim [other-service] doesn't contain an acceptable identifier. Expected kafka-broker as an aud value.] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:159) Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT (claims->{"sub":"variant-user","preferred_username":"variant-user","iss":"https://mock-idp.example.com","aud":"other-service","iat":1783743433,"exp":1783747093,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[8] Audience (aud) claim [other-service] doesn't contain an acceptable identifier. Expected kafka-broker as an aud value.] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:157) [2026-07-11 04:18:24,100] INFO [SocketServer listenerType=BROKER, nodeId=0] Failed authentication with /127.0.0.1 (channelId=127.0.0.1:48261-127.0.0.1:39512-0-1) ({"status":"invalid_token"}) (org.apache.kafka.common.network.Selector) [2026-07-11 04:18:24,463] WARN Could not validate the access token: JWT rejected due to invalid signature. Additional details: [[9] Invalid JWS Signature: JsonWebSignature{"alg":"RS256","kid":"pruva-trusted-key","typ":"JWT"}->eyJhbGciOiJSUzI1NiIsImtpZCI6InBydXZhLXRydXN0ZWQta2V5IiwidHlwIjoiSldUIn0.eyJzdWIiOiJ2YXJpYW50LXVzZXIiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ2YXJpYW50LXVzZXIiLCJpc3MiOiJodHRwczovL21vY2staWRwLmV4YW1wbGUuY29tIiwiYXVkIjoia2Fma2EtYnJva2VyIiwiaWF0IjoxNzgzNzQzNDMzLCJleHAiOjE3ODM3NDcwOTMsInNjb3BlIjoia2Fma2EtY2x1c3RlciJ9.Qh1Nwh2dzj98QGx6uWMFqERyEy5ZfLouy8INzfVBbCMn-IeX8YGUX6PbIe9uOTpwek-11G2FBQcN8HIvxccWN5lmMgmp-j0AE_g7Y_CXZDSLOwZBTbcw3TslI4PqVNTcfIod0KHb308ArOLlYyiGK_8UiYMZH_2C08Z26ZQyjVggGRFOmb0DmEBd3rudfn0FQMFzZkJipHLReYMlcX9PF75QjIV8IHvipuWXuIqpoPlo4QWD6SFN7Rk8iG-oV6k4f-BIGgChpKCB6B0ls7DIa_W3EYEgE0af87BFtryyuDoLxk3YI_X7duaAuDVEBSW3MvDclS0mNVrTjdKV1_12WA] (org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler) org.apache.kafka.common.security.oauthbearer.JwtValidatorException: Could not validate the access token: JWT rejected due to invalid signature. Additional details: [[9] Invalid JWS Signature: JsonWebSignature{"alg":"RS256","kid":"pruva-trusted-key","typ":"JWT"}->eyJhbGciOiJSUzI1NiIsImtpZCI6InBydXZhLXRydXN0ZWQta2V5IiwidHlwIjoiSldUIn0.eyJzdWIiOiJ2YXJpYW50LXVzZXIiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ2YXJpYW50LXVzZXIiLCJpc3MiOiJodHRwczovL21vY2staWRwLmV4YW1wbGUuY29tIiwiYXVkIjoia2Fma2EtYnJva2VyIiwiaWF0IjoxNzgzNzQzNDMzLCJleHAiOjE3ODM3NDcwOTMsInNjb3BlIjoia2Fma2EtY2x1c3RlciJ9.Qh1Nwh2dzj98QGx6uWMFqERyEy5ZfLouy8INzfVBbCMn-IeX8YGUX6PbIe9uOTpwek-11G2FBQcN8HIvxccWN5lmMgmp-j0AE_g7Y_CXZDSLOwZBTbcw3TslI4PqVNTcfIod0KHb308ArOLlYyiGK_8UiYMZH_2C08Z26ZQyjVggGRFOmb0DmEBd3rudfn0FQMFzZkJipHLReYMlcX9PF75QjIV8IHvipuWXuIqpoPlo4QWD6SFN7Rk8iG-oV6k4f-BIGgChpKCB6B0ls7DIa_W3EYEgE0af87BFtryyuDoLxk3YI_X7duaAuDVEBSW3MvDclS0mNVrTjdKV1_12WA] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:159) Caused by: org.jose4j.jwt.consumer.InvalidJwtSignatureException: JWT rejected due to invalid signature. Additional details: [[9] Invalid JWS Signature: JsonWebSignature{"alg":"RS256","kid":"pruva-trusted-key","typ":"JWT"}->eyJhbGciOiJSUzI1NiIsImtpZCI6InBydXZhLXRydXN0ZWQta2V5IiwidHlwIjoiSldUIn0.eyJzdWIiOiJ2YXJpYW50LXVzZXIiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ2YXJpYW50LXVzZXIiLCJpc3MiOiJodHRwczovL21vY2staWRwLmV4YW1wbGUuY29tIiwiYXVkIjoia2Fma2EtYnJva2VyIiwiaWF0IjoxNzgzNzQzNDMzLCJleHAiOjE3ODM3NDcwOTMsInNjb3BlIjoia2Fma2EtY2x1c3RlciJ9.Qh1Nwh2dzj98QGx6uWMFqERyEy5ZfLouy8INzfVBbCMn-IeX8YGUX6PbIe9uOTpwek-11G2FBQcN8HIvxccWN5lmMgmp-j0AE_g7Y_CXZDSLOwZBTbcw3TslI4PqVNTcfIod0KHb308ArOLlYyiGK_8UiYMZH_2C08Z26ZQyjVggGRFOmb0DmEBd3rudfn0FQMFzZkJipHLReYMlcX9PF75QjIV8IHvipuWXuIqpoPlo4QWD6SFN7Rk8iG-oV6k4f-BIGgChpKCB6B0ls7DIa_W3EYEgE0af87BFtryyuDoLxk3YI_X7duaAuDVEBSW3MvDclS0mNVrTjdKV1_12WA] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:157) [2026-07-11 04:18:24,464] INFO [SocketServer listenerType=BROKER, nodeId=0] Failed authentication with /127.0.0.1 (channelId=127.0.0.1:48261-127.0.0.1:39522-1-1) ({"status":"invalid_token"}) (org.apache.kafka.common.network.Selector)