OAuth2 Token Expiration Check Bypass in RabbitMQ Messaging Broker
CVE-2026-67242
6.3MEDIUM
What is CVE-2026-67242?
A vulnerability in RabbitMQ allows for OAuth2 tokens to bypass expiration checks when they are represented as float values. This can lead to the acceptance of expired tokens if the identity provider (IdP) issues tokens with float expiration times, which could result in unauthorized access. The affected versions, from 4.2.0 through 4.2.9 and 4.3.3, do not validate the expiration properly for these float values, thus compromising the security of connections. The issue has been addressed in subsequent releases.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3