diff --git a/clients/src/main/java/org/apache/kafka/common/security/JaasConfig.java b/clients/src/main/java/org/apache/kafka/common/security/JaasConfig.java
index 24bdac2378728..5e837a69c1602 100644
--- a/clients/src/main/java/org/apache/kafka/common/security/JaasConfig.java
+++ b/clients/src/main/java/org/apache/kafka/common/security/JaasConfig.java
@@ -81,6 +81,9 @@ public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
     }
 
     private LoginModuleControlFlag loginModuleControlFlag(String flag) {
+        if (flag == null)
+            throw new IllegalArgumentException("Login module control flag is not available in the JAAS config");
+
         LoginModuleControlFlag controlFlag;
         switch (flag.toUpperCase(Locale.ROOT)) {
             case "REQUIRED":
diff --git a/clients/src/test/java/org/apache/kafka/common/security/JaasContextTest.java b/clients/src/test/java/org/apache/kafka/common/security/JaasContextTest.java
index e8535d2c02c94..d96b359c1d3bf 100644
--- a/clients/src/test/java/org/apache/kafka/common/security/JaasContextTest.java
+++ b/clients/src/test/java/org/apache/kafka/common/security/JaasContextTest.java
@@ -174,6 +174,11 @@ public void testNumericOptionWithoutQuotes() throws Exception {
         checkInvalidConfiguration("test.testNumericOptionWithoutQuotes required option1=3;");
     }
 
+    @Test
+    public void testInvalidControlFlag() throws Exception {
+        checkInvalidConfiguration("test.testInvalidControlFlag { option1=3;");
+    }
+
     @Test
     public void testNumericOptionWithQuotes() throws Exception {
         Map<String, Object> options = new HashMap<>();