CVE-2026-107371

Published: Oct 13, 2026Modified: Oct 15, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: psirt@okta.com (Secondary)

Description

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v

Source: psirt@okta.com

https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371

Source: psirt@okta.com

Timeline

No history available yet.