CVE-2026-67242— RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
这段描述中存在一些明显的排版错误（如单词粘连、断行错误），例如“isinteger(Exp) guard”、“validatetokenexpiry/1”等，以及结尾处语句不完整。以下是经过纠错和润色后的中文翻译： --- RabbitMQ 是一种消息代理和流式处理平台。在版本 4.2.0 至 4.2.9（含）以及 4.3.3（含）之前，OAuth2 的身份验证逻辑存在缺陷。 具体来说， （第 208–214 行）和 （第 138–144 行）函数在使用 作为守卫条件时，仅对整数类型的 （过期时间）进行有效性检查。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67242
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 4.2.0, < 4.2.9 | - |
|
II. Public POCs for CVE-2026-67242
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67242
请登录查看更多情报信息。
Other References for CVE-2026-67242 (5)
-
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3 x_refsource_MISC
-
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9 x_refsource_MISC
Same Patch Batch · rabbitmq · 2026-09-25 · 28 CVEs total
| CVE-2026-67236 | 8.2 HIGH | RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST / |
| CVE-2026-67409 | 8.2 HIGH | RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Au |
| CVE-2026-67410 | 8.2 HIGH | RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint |
| CVE-2026-67239 | 7.6 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI |
| CVE-2026-67237 | 7.5 HIGH | RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint |
| CVE-2026-67408 | 7.1 HIGH | RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node |
| CVE-2026-67419 | 7.1 HIGH | RabbitMQ: Consecutive topic wildcards cause combinatorial routing work |
| CVE-2026-67226 | 6.9 MEDIUM | RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list |
| CVE-2026-61837 | 6.3 MEDIUM | RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authent |
| CVE-2026-67230 | 6.3 MEDIUM | RabbitMQ: Web-STOMP unbounded pre-auth accumulation |
| CVE-2026-67223 | 6.3 MEDIUM | RabbitMQ: LDAP DN injection via unescaped substitution |
| CVE-2026-67225 | 6.3 MEDIUM | RabbitMQ: Stream-protocol frame length never validated against frame_max |
| CVE-2026-66073 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via management API node field |
| CVE-2026-66071 | 6.0 MEDIUM | RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values |
| CVE-2026-67413 | 6.0 MEDIUM | RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an U |
| CVE-2026-67412 | 6.0 MEDIUM | RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message acces |
| CVE-2026-67411 | 6.0 MEDIUM | RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass |
| CVE-2026-67222 | 5.9 MEDIUM | RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client |
| CVE-2026-67227 | 5.9 MEDIUM | RabbitMQ: Atom exhaustion: to_atom on global-parameter :name |
| CVE-2026-67415 | 5.9 MEDIUM | RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Servic |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-613
-
CVE-2026-100711
froxlor before 2.3.12 Authentication Bypass via Session Pers -
CVE-2026-100624
Capgo.app before 12.264.5 Upload Expiry Bypass via build upl -
CVE-2026-100554
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass -
CVE-2026-100502
Flame through 2.4.0 Admin Token Insufficient Session Expirat -
CVE-2026-82566
Botslab G980H Dashcams Insufficient session expiration
V. Comments for CVE-2026-67242
No comments yet