CVE-2026-67410

Analyzed Analyzed - Analysis Complete

OAuth2 Client Secret Exposure in RabbitMQ Management UI

Publication date: 2026-09-25

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-08

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67410

EUVD

EUVD-2026-87238

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.9 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.2.0 to 4.3.3 and 4.2.9 have a vulnerability where the OAuth2 client secret is exposed via an unauthenticated JavaScript endpoint. When OAuth2 authentication is enabled for the RabbitMQ Management UI, the client secret is included in the JavaScript file served at /js/oidc-oauth/bootstrap.js. This allows unauthenticated users to retrieve the secret.

Detection Guidance

Check if the unauthenticated endpoint /js/oidc-oauth/bootstrap.js is accessible on the RabbitMQ Management UI port. Use curl to fetch the JavaScript file and inspect it for OAuth2 client secrets. Example command: curl http://<rabbitmq-server>:<management-port>/js/oidc-oauth/bootstrap.js | grep -i oauthclientsecret

Impact Analysis

An attacker could exploit this to steal the OAuth2 client secret, enabling them to complete the authorization code flow. This could lead to token theft, allowing the attacker to impersonate legitimate users and make unauthorized requests. Any user with access to the management UI port could retrieve the secret.

Compliance Impact

This vulnerability exposes OAuth2 client secrets via an unauthenticated endpoint, allowing unauthorized access to RabbitMQ management UI. This could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Unauthorized access may result in data breaches, triggering mandatory breach notification obligations under these regulations.

Mitigation Strategies

Upgrade RabbitMQ to version 4.3.3 or 4.2.9 or later. If upgrading is not immediately possible, disable OAuth2 authentication for the Management UI or restrict access to the Management UI port.

Hi! I’m here to help you understand CVE-2026-67410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70