CVE-2025-61673 Karapace is vulnerable to Authentication Bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-61673?
CVE-2025-61673 is a high-severity vulnerability in Aiven-Open karapace, published on 3 Oct 2025.
Official description
Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2.
Which versions are affected by CVE-2025-61673?
How do I fix CVE-2025-61673?
No fix has been published for CVE-2025-61673 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-61673 being exploited?
There is no known exploitation of CVE-2025-61673 in the wild and no public exploit code.
Sources
Also known as GHSA-vq25-vcrw-gj53.