MEDIUM 5.4 NVD
CVE-2026-107371
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.
References
- https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v
- https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth
This medium severity vulnerability with a CVSS score of 5.4 was published on 2026-10-13 via NVD.
vulnfeed aggregates 14602 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.