CVE-2026-85473

Awaiting Analysis Awaiting Analysis - Queue

Thread Termination via Invalid JWT Timestamp Claims in Auth0 Java-JWT

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Okta

Description

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85473

EUVD

EUVD-2026-100486

Affected Vendors & Products

Vendor	Product	Version / Range
Auth0	java-jwt	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-755	The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

Executive Summary

This vulnerability involves the auth0/java-jwt library terminating threads when processing JWTs with out-of-range timestamp claims like exp, nbf, or iat. The issue occurs during token parsing before signature verification, potentially causing service degradation if exploited repeatedly.

Impact Analysis

This vulnerability can lead to reduced availability of services using the affected library. Attackers could send maliciously crafted JWTs to trigger thread termination, causing performance degradation or service outages.

Mitigation Strategies

Update the auth0/java-jwt library to the latest version that fixes the issue. Implement input validation for JWT timestamp claims to reject out-of-range values before processing. Monitor system logs for repeated thread termination attempts.

Hi! I’m here to help you understand CVE-2026-85473. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70