Search
Find a vulnerability
Search criteria
2 vulnerabilities found for java-jwt by Auth0
CVE-2026-85473 (GCVE-0-2026-85473)
Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-13 20:15
VLAI
EPSS
VEX
Title
Out-of-Range Timestamp Claim Handling in auth0/java-jwt
Summary
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.
Severity
5.3 (Medium)
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "java-jwt",
"vendor": "Auth0",
"versions": [
{
"lessThan": "4.6.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "Improper Handling of Exceptional Conditions",
"lang": "en"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:15:27.938Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473"
},
{
"url": "https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade auth0/java-jwt to version 4.6.2 or greater."
}
],
"title": "Out-of-Range Timestamp Claim Handling in auth0/java-jwt"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-85473",
"datePublished": "2026-10-13T20:08:56.332Z",
"dateReserved": "2026-09-03T20:12:16.623Z",
"dateUpdated": "2026-10-13T20:15:27.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85473 (GCVE-0-2026-85473)
Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-13 20:15
VLAI
EPSS
VEX
Title
Out-of-Range Timestamp Claim Handling in auth0/java-jwt
Summary
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.
Severity
5.3 (Medium)
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "java-jwt",
"vendor": "Auth0",
"versions": [
{
"lessThan": "4.6.2",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "Improper Handling of Exceptional Conditions",
"lang": "en"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:15:27.938Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473"
},
{
"url": "https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade auth0/java-jwt to version 4.6.2 or greater."
}
],
"title": "Out-of-Range Timestamp Claim Handling in auth0/java-jwt"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-85473",
"datePublished": "2026-10-13T20:08:56.332Z",
"dateReserved": "2026-09-03T20:12:16.623Z",
"dateUpdated": "2026-10-13T20:15:27.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}