RabbitMQ versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 allow a man‑in‑the‑middle attacker to supply a forged JWKS response because the SSL options function falls back to no verification when a CA bundle is missing. This causes the broker to accept arbitrary JSON Web Tokens, effectively bypassing client authentication. The underlying weakness is in how SSL/TLS verification is performed, matching CWE‑295.

All installations of RabbitMQ Server running any of the affected releases — 3.13.0 through 3.13.14, 4.0.0 through 4.0.19, 4.1.0 through 4.1.10, 4.2.0 through 4.2.5, and 4.3.0 through the listed patch — are vulnerable when the OAuth2 plugin is enabled, no cacertfile is configured, and the operating system cannot provide a usable CA bundle. The vulnerability exists in containerised or minimal environments where default certificates are absent.

The vulnerability is rated 9.2 on the CVSS scale, indicating high severity. EPSS data is not available, but the required configuration implies an attacker must position themselves as a network man‑in‑the‑middle and the server must be misconfigured. Because the weakness exploits SSL/TLS verification, exploitation is straightforward once the prerequisites are met; it does not require code execution on the broker itself. The vulnerability is not listed in CISA’s KEV catalog at this time.