GET /api/auth on RabbitMQ's management interface can return the OAuth 2 client secret when the management.oauth_client_secret configuration is set. This flaw results in unauthorized disclosure of a credential that authenticates to OAuth services, representing a data confidentiality compromise (CWE‑200). The vulnerability is limited to the configuration of the obsolete GET endpoint and affects only installations that enable the management plugin and define an OAuth client secret. Based on the description, it is inferred that an attacker could use the disclosed secret to authenticate as the OAuth client or generate tokens that appear legitimate.

RabbitMQ Server installations running any of the four versions prior to 3.13.15, 4.0.20, 4.1.11, or 4.2.6 that have the management plugin enabled and a management.oauth_client_secret configured are vulnerable. The flaw is fixed in the mentioned newer releases.

The CVSS score of 8.7 indicates a high‑severity data disclosure. Attackers only need to send an unauthenticated HTTP GET request to /api/auth on a reachable management interface. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. Because the exposed credential can be misused by any entity reaching the management endpoint, the risk to the organization remains significant even with a low exploitation likelihood.