BIT-RABBITMQ-2026-67242 RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isintegerExp guard skips token-expiry checks for float exp. validatetokenexpiry/1 lines 208-214 and expirytimestamp/1 138-144 both guard with 'when isintegerExp' and fall through to ok/never for float values...

PT-2026-98914

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An issue exists in the OAuth2 implementation where token expiry checks are skipped if the Identity Provider IdP emits the exp claim as a JSON float. This...