RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set token auth/2 inserted a bearer token from the Authorization header or access token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.