In RabbitMQ server versions >=4.2.0 <4.2.8 and >=4.3.0 <4.3.2, a successful POST to /login causes the is_authorized/2 function to set an authentication cookie containing base64-encoded username:password credentials. This cookie lacks HttpOnly, Secure, SameSite, and expiration protections. Since base64 encoding is reversible, an attacker with same-origin cross-site scripting, network visibility, or local browser access can retrieve the actual login credentials. Older browsers that treat absent SameSite attributes as None may send the cookie cross-site, increasing risk. The vulnerability is addressed in versions 4.2.8 and 4.3.2.

An attacker able to execute same-origin cross-site scripting, intercept HTTP traffic, or access the browser's cookie store can recover plaintext login credentials from the authentication cookie. This compromises user credentials and potentially allows unauthorized access to RabbitMQ services. The vulnerability is rated high severity with a CVSS 4.0 score of 8.2.

This vulnerability is fixed in RabbitMQ versions 4.2.8 and 4.3.2. Users should upgrade to at least these versions to mitigate the issue. No other vendor advisory mitigation instructions are provided.