RabbitMQ server versions prior to 4.2.8 and 4.3.2 store the username and password as a base64‑encoded string in a cookie after a successful POST /login. The cookie is delivered without HttpOnly, Secure, SameSite, or expiration attributes, allowing an attacker who can read the browser’s cookie store or inject same‑origin cross‑site scripting to recover the plaintext credentials. The compromised credentials can then be used to authenticate as the user or gain unauthorized access to RabbitMQ management APIs. This is a classic improper credential handling flaw (CWE‑312).

The vendor rabbitmq, product rabbitmq‑server is affected. All releases from 4.2.0 through 4.2.7 inclusive, and any 4.3.x releases prior to 4.3.2, suffer from the vulnerability. These versions are fixed in releases 4.2.8 and 4.3.2 and later, so any deployment using the affected releases is impacted.

The CVSS score of 8.2 indicates a high‑impact vulnerability that can be exploited remotely. Exploitation requires only a successful authentication flow and does not need privileged access. An attacker with same‑origin cross‑site scripting, the capacity to read network traffic, or local browser cookie store access can recover actual login credentials. Because the EPSS score is not available, the exact likelihood of exploitation is uncertain, but the absence of security headers keeps the risk elevated until the cookie handling is corrected. The vulnerability is not listed in the CISA KEV catalog.