A legacy management API in specific RabbitMQ deployments could disclose an OAuth client secret, creating a path from credential exposure to broker control.