CVE-2025-61673 Details
Description
Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2.
An authentication bypass vulnerability has been identified in Karapace versions 5.0.0 and 5.0.1, specifically when OAuth 2.0 Bearer Token authentication is enabled. The vulnerability arises because requests lacking an Authorization header bypass the token validation process, allowing unauthenticated users to access and modify Schema Registry endpoints that should be secured. This flaw undermines the effectiveness of the OAuth authentication mechanism.
Users are advised to upgrade to Karapace version 5.0.2, which addresses this vulnerability by enforcing token validation for requests when OAuth Bearer authentication is enabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 3, 2025CISA-ADP
Assessed Oct 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7 | [email protected] | Source CodeVendor |
| https://github.com/Aiven-Open/karapace/releases/tag/5.0.2 | [email protected] | Release NotesVendor |
| https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Aiven-Open karapace | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 3, 2025 | New CVE Received | [email protected] |