PT-2026-113367 · Auth0 · Auth0.Js
CVE-2026-107371
·
Published
2026-10-13
·
Updated
2026-10-13
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Auth0.Js