RabbitMQ up to 4.2.8/4.3.2 OAuth2 validatetokenexpiry Exp session expiration

Summaryinfo

A vulnerability was found in RabbitMQ up to 4.2.8/4.3.2 and classified as critical. Affected by this vulnerability is the function validatetokenexpiry of the component OAuth2. Executing a manipulation of the argument Exp can lead to session expiration. The identification of this vulnerability is CVE-2026-67242. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in RabbitMQ up to 4.2.8/4.3.2. It has been declared as critical. This vulnerability affects the function validatetokenexpiry of the component OAuth2. The manipulation of the argument Exp with an unknown input leads to a session expiration vulnerability. The CWE definition for the vulnerability is CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-67242 since 07/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 4.2.9 or 4.3.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• RabbitMQ

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.3.0
• 4.3.1
• 4.3.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion