A vulnerability in the RabbitMQ OAuth2/JWT authentication process allows an attacker to trigger a persistent denial of service for all users by forcing the destruction of cached signing keys.

This issue is an unchecked return value (CWE-252) within the JWKS key fetching logic. The system incorrectly processes non-200 HTTP responses from the OAuth2 provider, leading to the deletion of active signing keys and causing a total authentication failure for all users.

Successful exploitation of this vulnerability results in a complete denial of service for any users or services relying on OAuth2/JWT for authentication. Given the critical role of RabbitMQ in messaging infrastructure, this could cause widespread operational downtime and service disruption. The CVSS score of 8.2 reflects the high impact on availability, justifying an urgent response to restore system stability.

Immediate Action: Update the RabbitMQ server to versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, or 3.13.18 as appropriate for your current release branch.

Proactive Monitoring: Monitor authentication logs for sudden, widespread login failures or repeated errors originating from the OAuth2 provider integration.

Compensating Controls: While a Web Application Firewall cannot directly patch this code-level logic, ensure that egress traffic to the OAuth2 provider is strictly controlled to prevent unauthorized entities from manipulating the JWKS endpoint responses.

Public Exploit Available: Unknown.

The potential for a complete, persistent outage of authentication services makes this vulnerability a high priority for remediation. Administrators should verify their current version against the affected ranges and apply the vendor-provided patches immediately to ensure the continuity of message broker operations.