The vulnerability allows a user with a monitoring tag to send a DELETE request to the /api/auth/attempts endpoint and reset per‑node authentication attempt counters. While the counters are only cosmetic, this action removes evidence of brute‑force or other authentication‑related attacks, undermining forensic investigation and audit trails. The flaw arises from the use of is_authorized_monitor in is_authorized/2 for all methods, bypassing the stricter authorization normally required for such operations, which relates to CWE-862.

RabbitMQ Server is affected. Versions prior to 4.1.13, 4.2.7, and 4.3.0 are vulnerable. The issue is resolved in 4.1.13, 4.2.7, and 4.3.0.

The CVSS score of 2.3 indicates a low severity, and the EPSS score is not available, suggesting a limited exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires a user who has the monitoring tag and the Management plugin enabled; the user does not need administrator privileges. Once the preconditions are met, the attacker can erase authentication attempt evidence by issuing a DELETE request, but cannot directly affect other data or configurations.