CVE-2026-33557: Apache Kafka SASL/OAUTHBEARER accepts unvalidated JWTs

Suspected authentication bypass in Apache Kafka broker-side SASL/OAUTHBEARER token acceptance path. The broker appears to accept historical JWT session tokens indefinitely because the unauthenticated token acceptance path does not enforce the JWT exp claim on replay. An attacker holding any previously issued Kafka session JWT can replay it after expiration and still authenticate successfully. This is distinct from generic token validation issues because the claim failure is specifically in exp enforcement on the broker side. Investigate broker-side SASL/OAUTHBEARER handling for expired-but-signed tokens, the exact validation path used during initial connection establishment, and whether the default validator or an alternate callback path bypasses exp checking. Scope: latest Apache Kafka release line unless a patched release already covers this behavior.