Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67242)

The RabbitMQ server's OAuth2 implementation improperly validates the 'exp' (expiry) claim in JWT tokens when the 'exp' value is a floating-point number. The functions validatetokenexpiry/1 and expirytimestamp/1 only perform expiry checks when 'exp' is an integer, ignoring float values. Since RFC 7519 permits fractional NumericDate values, tokens with float 'exp' values bypass expiry validation entirely. This flaw allows an attacker possessing a previously valid signed token with a float 'exp' to use expired tokens indefinitely, as neither login-time expiry checks nor mid-connection disconnect timers are enforced. This vulnerability affects RabbitMQ versions from 4.2.0 up to but not including 4.2.9 and 4.3.3, where the issue has been fixed.

An attacker with a previously valid signed token can bypass token expiry checks if the token's 'exp' claim is a float, allowing use of expired tokens to maintain unauthorized access. This undermines session expiration controls and could lead to prolonged unauthorized access to RabbitMQ services when OAuth2 backend is enabled and the Identity Provider emits float 'exp' values. The impact is limited to environments using OAuth2 with such token formats, which is uncommon as mainstream IdPs typically emit integer 'exp' values.

Upgrade RabbitMQ to version 4.2.9 or 4.3.3 or later, where this vulnerability is fixed. If upgrading immediately is not possible, verify that the Identity Provider does not emit float 'exp' values in tokens or implement additional token validation to reject tokens with non-integer 'exp' claims. No other vendor advisories or patches are provided; patch status is confirmed fixed in 4.2.9 and 4.3.3.