CVE-2026-67242

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.

• CWE-613

• https://github.com/rabbitmq/rabbitmq-server/commit/d10a369a96658d0fba1050bd43c732e58fcf28fd
• https://github.com/rabbitmq/rabbitmq-server/commit/f189a8824c9efbce46bd9438fcdbda4521cfc923
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rrj4-g94f-rqj9
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rrj4-g94f-rqj9

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67236RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…8.2
• CVE-2026-67237RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…7.5
• CVE-2026-67238RabbitMQ is a messaging and streaming broker. Prior to versi…7.1
• CVE-2026-67239RabbitMQ is a messaging and streaming broker. From 3.13.0 un…7.6
• CVE-2026-67240RabbitMQ is a messaging and streaming broker. Prior to versi…2.3
• CVE-2026-67241RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…4.8
• CVE-2026-67243freo2 provided by refirio contains an unrestricted upload of…8.6
• CVE-2026-67244A format string vulnerability was found in the Notification …7.2
• CVE-2026-67245A path traversal vulnerability was found in the VPN Clients …8.1
• CVE-2026-67246A path traversal vulnerability was found in the Wallpaper co…6.5
• CVE-2026-67247A path traversal vulnerability was found in the IHM Log hand…6.5
• CVE-2026-67248A stack-based buffer overflow vulnerability was found in the…8.8