BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Apache

CVE-2026-110985: A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from conf

CVE-2026-110985 Oct 28, 2026 Source: Vendor

A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and no verification key resolver is supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not verify the JWT signature, algorithm, or issuer - and the broker starts with no

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-110985
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines
All 2 CVEs 2 Additional recognition 0 Unclaimed only
Showing 1–2 of 2
CVE-2026-110985 BR2026-0000-037888 unclaimed
Credited as San Zhang
CVE-2026-110985 BR2026-0000-037889 unclaimed
Credited as Kaixuan Li