Search: CVE-2026-67409

CVE-2026-67409 is a vulnerability in RabbitMQ server versions from 3.13.0 up to but not including 3.13.18, and similarly in 4.0.x, 4.1.x, 4.2.x, and 4.3.x prior to fixed versions. The issue arises because the JWKS key fetching mechanism does not validate HTTP response status codes when retrieving signing keys from the OAuth2 provider. As a result, error responses with valid JSON but missing keys cause all cached signing keys to be destroyed, leading to persistent denial of OAuth2/JWT authentication until a successful refresh occurs. This can cause a denial of service affecting all users relying on OAuth2 authentication.