A missing Origin header validation in the Web‑MQTT and Web‑STOMP handlers of RabbitMQ allows a malicious actor running JavaScript in a victim’s browser to authenticate automatically with the broker when the ssl_cert_login or use_http_auth configuration options are enabled. Because the broker accepts the browser‑driven client certificate without verifying its origin, the attacker can impersonate the victim and perform any operations that the authenticated user is permitted, potentially exposing or manipulating message traffic.

RabbitMQ Server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are susceptible. The vulnerability resides in the Web‑MQTT (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl) and Web‑STOMP (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl) handlers. All installations that enable ssl_cert_login (for Web‑MQTT) or use_http_auth (for Web‑STOMP) without validating the Origin header are affected.

The CVSS score of 5.3 indicates a moderate severity; the exploitation probability is not quantified (EPSS not available), and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is exploiting client‑side JavaScript executed in the victim’s browser, which can automatically authenticate using a client certificate when ssl_cert_login or use_http_auth is enabled. Attackers must have code execution ability in the victim’s browser and the broker must be configured with ssl_cert_login or use_http_auth. Once achieved, the attacker can gain unauthorized access to publish or subscribe on the broker using the victim’s identity, which can lead to data exposure or disruption. The risk is higher for environments using the specific SSL or HTTP authentication settings mentioned in the advisory.