{"id":"CVE-2026-67242","title":"RabbitMQ is a messaging and streaming broker","summary":"RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'w…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-613"],"vendor":"broadcom","product":"rabbitmq_server","affected":["rabbitmq_server >= 4.2.0, < 4.2.9","rabbitmq_server >= 4.3.0, < 4.3.3"],"patched":["rabbitmq_server 4.3.3"],"published":"2026-09-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T16:22:54.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67242","references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/d10a369a96658d0fba1050bd43c732e58fcf28fd","label":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/f189a8824c9efbce46bd9438fcdbda4521cfc923","label":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9","label":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3","label":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rrj4-g94f-rqj9","label":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rrj4-g94f-rqj9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67242.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67242"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541506"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67242"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67242"},{"url":"https://access.redhat.com/errata/RHSA-2026:67552"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00345,"epssPercentile":0.27805,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-25T20:01:04.290645Z"},"scores":{"nvd":5.4,"cna":6.3,"vendor":4.8},"ingestedAt":"2026-09-25T17:13:14.026Z","slug":"CVE-2026-67242","body":"## Overview\n\nRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.\n\n## Affected\n\n- `rabbitmq_server >= 4.2.0, < 4.2.9`\n- `rabbitmq_server >= 4.3.0, < 4.3.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rabbitmq_server 4.3.3`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Hardened Images, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67242.json)\n- **RHSA-2026:67552** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67552)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":230353,"id":"CVE-2026-67242","ts":1793130920049,"field":"cvss","old":"6.3","new":"5.4"},{"seq":211165,"id":"CVE-2026-67242","ts":1790367520148,"field":"exploit_available","old":"false","new":"true"}]}