RabbitMQ server versions from 3.13.0 up to but not including 3.13.19, 4.0.0 up to 4.0.24, 4.1.0 up to 4.1.15, 4.2.0 up to 4.2.10, and 4.3.0 up to 4.3.5 contain a missing authorization vulnerability (CWE-862) related to OAuth credential refresh. When an AMQP connection refreshes its OAuth token to a downgraded token that no longer grants the impersonator tag, RabbitMQ updates the backend token information but fails to remove the stale impersonator tag from the connection's runtime user tags. Consequently, the connection retains elevated privileges and can continue publishing messages as a foreign AMQP user after those privileges should have been revoked. This flaw affects only connections that previously held the impersonator tag and use a refresh-capable OAuth backend. The vulnerability is resolved in the specified fixed versions.

The vulnerability allows an AMQP connection that once had impersonator privileges to retain those privileges after the OAuth token is refreshed to a downgraded token without the impersonator tag. This can lead to unauthorized message publishing under a foreign AMQP user identity. However, the impact is limited to existing connections that refresh tokens and is mitigated for new connections which correctly enforce the downgraded privileges. The CVSS 4.0 score is 2.3, indicating low severity.

A fix is available and has been released in RabbitMQ versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. Users should upgrade to these or later versions to remediate the issue. No additional mitigations are specified or required beyond applying the official patches.