RabbitMQ’s OAuth2 guard incorrectly permits tokens whose expiration claim is a floating point number. The guard only checks expiration when the value is an integer; when a float is provided the check is skipped, so a token that has already expired is accepted as valid. An attacker who can supply a previously signed, expired token can keep an authenticated session alive indefinitely, potentially gaining continued access to broker resources. The vulnerability directly undermines the trust model of OAuth2 and allows unauthorized subscription or publishing to queues that should be protected by token lifetime.

RabbitMQ Server versions from 4.2.0 through 4.2.8 and from 4.3.0 through 4.3.2 are affected. The issue is resolved in releases 4.2.9 and 4.3.3 and later versions.

The CVSS score of 6.3 indicates moderate severity. EPSS data are not provided, and the vulnerability is not listed in CISA’s KEV catalog, but the attack can be performed from any system that can obtain a signed JWT from an OAuth2 identity provider. If the IdP emits a floating point expiration value, an attacker can exploit the flaw without additional privileges by presenting the token to RabbitMQ. The vulnerability’s impact relies on the attacker’s ability to obtain a valid, previously issued token, which is a common capability in OAuth2 deployments.