JWT Authentication: blockUnknown default allows unauthenticated access contrary to documentation

{
  "id": "a51c4039c96cee58f40e9d589fce55fe0d1bc6ef10d86f3877527b2c0a780005",
  "url": "https://solr.apache.org/jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation.html",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "JWT Authentication: blockUnknown default allows unauthenticated access contrary to documentation",
    "summary": "The JWT Authentication Plugin’s code default for blockUnknown is false, despite documentation stating it defaults to true. Operators intending to block unauthenticated requests may be affected if they use the plugin, leave blockUnknown unset, and have no independent authorization plugin denying anonymous access. Set blockUnknown to true as a mitigation; upcoming releases will change the default.",
    "evidence": "The Apache Solr JWT Authentication Plugin has a configuration parameter blockUnknown that controls whether anonymous (unauthenticated) requests are blocked. The Reference Guide has documented this as defaulting to true since Solr 9.0, but the code default has always been false.",
    "products": [
      {
        "name": {
          "value": "Apache Solr",
          "evidence": "Apache Solr 9.0.0 through 9.10.1"
        },
        "prerequisites": [
          {
            "value": "You use the JWT Authentication Plugin (solr.JWTAuthPlugin) in security.json",
            "evidence": "You use the JWT Authentication Plugin (solr.JWTAuthPlugin) in security.json"
          },
          {
            "value": "Your intention is to block all unauthenticated requests",
            "evidence": "Your intention is to block all unauthenticated requests"
          },
          {
            "value": "Your security.json does not explicitly set blockUnknown to true",
            "evidence": "Your security.json does not explicitly set blockUnknown to true"
          },
          {
            "value": "You are not affected if any of the following applies: blockUnknown is explicitly set to true in security.json",
            "evidence": "You are not affected if any of the following applies: blockUnknown is explicitly set to true in security.json"
          },
          {
            "value": "An AuthorizationPlugin (e.g. RuleBasedAuthorizationPlugin) independently denies access to unauthenticated users",
            "evidence": "An AuthorizationPlugin (e.g. RuleBasedAuthorizationPlugin) independently denies access to unauthenticated users"
          }
        ],
        "fixed_versions": [
          {
            "value": "9.11",
            "evidence": "Upcoming Solr 9.11 and 10.1 releases will change the code default of blockUnknown to true."
          },
          {
            "value": "10.1",
            "evidence": "Upcoming Solr 9.11 and 10.1 releases will change the code default of blockUnknown to true."
          }
        ],
        "affected_versions": [
          {
            "value": "9.0.0 through 9.10.1",
            "evidence": "Versions Affected Apache Solr 9.0.0 through 9.10.1 Apache Solr 10.0.0"
          },
          {
            "value": "10.0.0",
            "evidence": "Versions Affected Apache Solr 9.0.0 through 9.10.1 Apache Solr 10.0.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-apache-solr-security",
  "document_id": 22969,
  "published_at": "2026-05-19T00:00:00+00:00"
}