CVE-2021-22160: 
Java vulnerability analysis and mitigation

CVE-2021-22160 is a critical security vulnerability discovered in Apache Pulsar affecting versions prior to 2.7.1. The vulnerability was disclosed on May 26, 2021, and involves a flaw in the JSON Web Token (JWT) authentication mechanism (NVD).

The vulnerability occurs when Apache Pulsar is configured to authenticate clients using JSON Web Tokens (JWT). The core issue is that the system fails to validate the token signature when the algorithm of the presented token is set to "none". This vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating its severe nature (NVD).

The vulnerability allows an attacker to connect to Pulsar instances as any user, including administrators, effectively bypassing authentication controls. This could lead to unauthorized access to sensitive data and system controls (NVD).

The vulnerability was addressed in Apache Pulsar version 2.7.1. Users running affected versions should upgrade to version 2.7.1 or later to mitigate this security risk. Additionally, a separate 2.6.4 release was created to address this vulnerability in the 2.6.x branch (Apache Mailing List).