Apache Pulsar JSON Web Token Authentication Bypass (CVE-2021-22160)

An authentication bypass vulnerability exists in the JSON Web Token authentication module of Apache Pulsar. The vulnerability is due to improper handling of unsigned JSON Web Tokens...

CVE-2021-22160

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...

CVE-2021-22160 Authentication with JWT allows use of “none”-algorithm

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...