CVE-2026-100252 Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...