CVE-2025-61673

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61673", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-29T20:25:16.180Z", "datePublished": "2025-10-03T21:12:24.471Z", "dateUpdated": "2025-10-06T13:19:08.624Z"}, "containers": {"cna": {"title": "Karapace is vulnerable to Authentication Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-288", "lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53"}, {"name": "https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7", "tags": ["x_refsource_MISC"], "url": "https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7"}, {"name": "https://github.com/Aiven-Open/karapace/releases/tag/5.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Aiven-Open/karapace/releases/tag/5.0.2"}], "affected": [{"vendor": "Aiven-Open", "product": "karapace", "versions": [{"version": ">= 5.0.0, < 5.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T21:12:24.471Z"}, "descriptions": [{"lang": "en", "value": "Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2."}], "source": {"advisory": "GHSA-vq25-vcrw-gj53", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T13:18:49.016628Z", "id": "CVE-2025-61673", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T13:19:08.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T13:18:49.016628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T13:18:54.419Z"}}], "cna": {"title": "Karapace is vulnerable to Authentication Bypass", "source": {"advisory": "GHSA-vq25-vcrw-gj53", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Aiven-Open", "product": "karapace", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.2"}]}], "references": [{"url": "https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53", "name": "https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7", "name": "https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Aiven-Open/karapace/releases/tag/5.0.2", "name": "https://github.com/Aiven-Open/karapace/releases/tag/5.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T21:12:24.471Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61673", "state": "PUBLISHED", "dateUpdated": "2025-10-06T13:19:08.624Z", "dateReserved": "2025-09-29T20:25:16.180Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-03T21:12:24.471Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "karapace", "vendor": "Aiven-Open", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2."}, {"lang": "es", "value": "Karapace es una implementaci\u00f3n de c\u00f3digo abierto de Kafka REST y Schema Registry. Las versiones 5.0.0 y 5.0.1 contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n cuando se configuran para usar autenticaci\u00f3n de token de portador OAuth 2.0. Si se env\u00eda una solicitud sin un encabezado de autorizaci\u00f3n, la l\u00f3gica de validaci\u00f3n del token se omite por completo, permitiendo a un usuario no autenticado leer y escribir en los puntos finales de Schema Registry que de otro modo deber\u00edan estar protegidos. Esto efectivamente hace que el mecanismo de autenticaci\u00f3n OAuth sea ineficaz. Este problema se corrige en la versi\u00f3n 5.0.2."}], "id": "CVE-2025-61673", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61673", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T13:18:49.016628Z", "version": "2.0.3"}}]}, "published": "2025-10-03T22:15:32.213", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Aiven-Open/karapace/pull/1143/commits/c4038e9ce9fa504b433d59ac2944e337292922c7"}, {"source": "security-advisories@github.com", "url": "https://github.com/Aiven-Open/karapace/releases/tag/5.0.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Aiven-Open/karapace/security/advisories/GHSA-vq25-vcrw-gj53"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-06T14:42:20.380414+00:00", "updated": "2025-10-06T14:42:20.380489+00:00", "vendors": ["aiven", "aiven$PRODUCT$aiven", "aiven$PRODUCT$karapace"]}