RabbitMQ AMQP 0‑9‑1 channels authenticated with OAuth 2 tokens can continue to receive messages after the token expires, is revoked or its scopes are reduced, because the broker does not cancel or reauthorize the consumer at delivery time. Based on the description, it is inferred that an attacker who holds a valid token and then causes its revocation can still intercept messages that should belong to another user. This weakness represents a failure to enforce proper authorization after state changes and is classified as CWE‑863. The CVSS score of 4.9 reflects moderate severity.

Versions of RabbitMQ prior to 4.2.6, especially those using AMQP 0‑9‑1 with OAuth 2, are affected. The flaw is present in all 4.2.x releases older than 4.2.6, and the issue is fixed by updating to RabbitMQ 4.2.6 or newer.

The EPSS score is less than 1% and the vulnerability has not been listed in CISA KEV, indicating low documented exploitation. Based on the description, it is inferred that an attacker who can obtain a valid OAuth token and subsequently trigger its revocation or scope reduction has a straightforward path to read privileged messages. The moderate CVSS score of 4.9 indicates that the risk is medium in environments that rely on OAuth 2 for message access control. The likelihood of exploitation remains low but should not be ignored.