CVE-2026-67242 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with OAuth2 backend enabled should verify and update their configurations to prevent potential unauthorized access. This includes reviewing OAuth2 backend configuration for float exp values and implementing additional token expiry validation checks.

Why it matters

The vulnerability allows an attacker to bypass token expiry validation checks, potentially leading to unauthorized access. RabbitMQ administrators and users with OAuth2 backend enabled should verify and update their configurations.

• Bypass of token expiry validation checks
• Potential for expired tokens to be accepted
• Increased risk of unauthorized access

Technical summary

The vulnerability exists in RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2, where the OAuth2 token expiry check is bypassed due to incorrect handling of float exp values. The 'isinteger(Exp)' guard in validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) fall through to ok/never for float values, allowing an attacker to bypass token expiry validation checks. This issue is fixed in versions 4.2.9 and 4.3.3. RabbitMQ administrators and users with OAuth2 backend enabled should verify and update their configurations.

Defensive priority

Verify token expiry validation for OAuth2 backends

Recommended defensive actions

• Verify and update RabbitMQ to version 4.2.9 or 4.3.3
• Review OAuth2 backend configuration for float exp values
• Implement additional token expiry validation checks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2, where the OAuth2 token expiry check is bypassed due to incorrect handling of float exp values. The issue is caused by the 'isinteger(Exp)' guard in validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) which fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the system. The IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), an

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.