RabbitMQ AMQP 0-9-1 prior to version 4.2.6 contains an incorrect authorization vulnerability (CWE-863) where consumers remain active and continue receiving messages despite OAuth token expiry or scope reduction through connection.update_secret refresh. This happens because the server does not cancel or reauthorize existing consumers at message delivery time after user state changes on the channel. This flaw could allow consumers to receive messages beyond their authorized scope until the channel is closed or the consumer is explicitly canceled. The vulnerability is resolved in RabbitMQ version 4.2.6.

An attacker or legitimate consumer with a previously valid OAuth token can continue to receive messages after the token expires or its permissions are reduced, potentially leading to unauthorized message consumption. This could result in unauthorized access to sensitive message data until the consumer is canceled or the channel is closed. The CVSS score of 4.9 (medium severity) reflects the moderate risk due to the need for an existing consumer and limited scope of impact.

Upgrade RabbitMQ server to version 4.2.6 or later, where this authorization issue is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is not explicitly stated but the vendor fix is confirmed in version 4.2.6.