CVE-2025-61673

Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7
https://github.com/Aiven-Open/karapace/releases/tag/5.0.2
https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53

Configurations

No configuration.

History

08 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Karapace es una implementación de código abierto de Kafka REST y Schema Registry. Las versiones 5.0.0 y 5.0.1 contienen una vulnerabilidad de omisión de autenticación cuando se configuran para usar autenticación de token de portador OAuth 2.0. Si se envía una solicitud sin un encabezado de autorización, la lógica de validación del token se omite por completo, permitiendo a un usuario no autenticado leer y escribir en los puntos finales de Schema Registry que de otro modo deberían estar protegidos. Esto efectivamente hace que el mecanismo de autenticación OAuth sea ineficaz. Este problema se corrige en la versión 5.0.2.

Information

Published : 2025-10-03 22:15

Updated : 2026-10-08 22:10

NVD link : CVE-2025-61673

Mitre link : CVE-2025-61673

CVE.ORG link : CVE-2025-61673

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-61673", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61673", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T13:18:49.016628Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Aiven-Open", "product": "karapace", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.2"}]}]}], "published": "2025-10-03T22:15:32.213", "references": [{"url": "https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7", "source": "security-advisories@github.com"}, {"url": "https://github.com/Aiven-Open/karapace/releases/tag/5.0.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2."}, {"lang": "es", "value": "Karapace es una implementaci\u00f3n de c\u00f3digo abierto de Kafka REST y Schema Registry. Las versiones 5.0.0 y 5.0.1 contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n cuando se configuran para usar autenticaci\u00f3n de token de portador OAuth 2.0. Si se env\u00eda una solicitud sin un encabezado de autorizaci\u00f3n, la l\u00f3gica de validaci\u00f3n del token se omite por completo, permitiendo a un usuario no autenticado leer y escribir en los puntos finales de Schema Registry que de otro modo deber\u00edan estar protegidos. Esto efectivamente hace que el mecanismo de autenticaci\u00f3n OAuth sea ineficaz. Este problema se corrige en la versi\u00f3n 5.0.2."}], "lastModified": "2026-10-08T22:10:00.563", "sourceIdentifier": "security-advisories@github.com"}