CVE-2026-67242

Undergoing Analysis Undergoing Analysis - In Progress

OAuth2 Token Expiry Bypass in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67242

EUVD

EUVD-2026-87158

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.2.9 (inc)
rabbitmq	rabbitmq	4.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.2.0 to 4.2.9 and 4.3.3 have an OAuth2 token validation flaw where expiry checks are skipped if the token's expiration time is a float instead of an integer. This allows expired tokens to be accepted, potentially granting unauthorized access.

Detection Guidance

This vulnerability can be detected by checking RabbitMQ versions for affected releases (4.2.0 to 4.2.9 and 4.3.0 to 4.3.2) and verifying if OAuth2 is enabled with an IdP emitting float exp values. Check RabbitMQ logs for unexpected token acceptance without expiry validation.

Impact Analysis

An attacker could exploit this to maintain access using an expired token, bypassing authentication and potentially gaining unauthorized access to RabbitMQ resources or data.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements in GDPR and HIPAA, potentially resulting in compliance breaches and legal consequences.

Mitigation Strategies

Upgrade RabbitMQ to version 4.2.9 or 4.3.3 or later to address the OAuth2 token expiry bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-67242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70