CVE-2026-107371

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass via auth_time Validation in Auth0.js

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Okta

Description

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107371

EUVD

EUVD-2026-100483

Affected Vendors & Products

Vendor	Product	Version / Range
Auth0	auth0.js	9.12.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability involves the Auth0.js library's authorize() method. When maxAge is specified, the library fails to check if the auth_time claim in the ID token matches the requested maxAge. This allows an application to accept an ID token from an authentication event older than the allowed maximum age.

Impact Analysis

An attacker could exploit this to reuse an old but valid ID token, gaining unauthorized access to an application as if the user had recently authenticated. This could lead to session hijacking or privilege escalation if the application relies on maxAge for session freshness.

Compliance Impact

This vulnerability may violate compliance requirements that mandate recent authentication for sensitive actions, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized access due to stale tokens could result in non-compliance penalties.

Mitigation Strategies

Update the auth0.js library to the latest version where the auth_time claim is properly validated against the maxAge parameter to prevent processing stale authentication tokens.

Hi! I’m here to help you understand CVE-2026-107371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70