Executive brief
Klaw, a self-service portal for managing Apache Kafka, is vulnerable to a flaw that allows users to lock others out of their accounts. By registering a username that differs only in capitalization from an existing user, an attacker can cause both accounts to become inaccessible. This results in a denial of service for legitimate users and prevents administrators from managing the affected accounts through the standard interface.
Technical details
A vulnerability exists in Klaw's user management due to a discrepancy between case-sensitive registration validation (using Objects.equals) and case-insensitive login lookups (using findByUsernameIgnoreCase). An attacker with registration privileges can create a username that is a case-variant of an existing user (e.g., 'Admin' vs 'admin'), causing a collision that prevents both users from logging in. This collision also breaks administrative management tools, making it impossible for a superadmin to delete the conflicting accounts via the UI. The issue is fixed in version 2.10.4 by enforcing consistent case-insensitive handling; however, existing collisions require manual database intervention to resolve.
Affected products
- Aiven-Open Klaw < 2.10.4
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: patched: Version 2.10.4 released
- 2026-06-02: disclosed: CVE-2026-44367 published to NVD