Authentication Bypass Vulnerability in Karapace by Aiven

CVE-2025-61673

What is CVE-2025-61673?

Karapace, an open-source implementation of Kafka REST and Schema Registry, has a notable security vulnerability in versions 5.0.0 and 5.0.1. When using OAuth 2.0 Bearer Token authentication, a significant flaw allows unauthenticated users to bypass token validation entirely if requests are made without an Authorization header. This oversight means that unauthorized individuals can access and manipulate Schema Registry endpoints that should be securely protected, thus undermining the intended security of the OAuth authentication scheme. The issue is remedied in version 5.0.2.

References