CVE-2026-107371

5.4 Moyenne

Publiée le 13/10/2026 à 23:17 · Modifiée le 15/10/2026 à 22:38 · En attente d'analyse NVD · Source : psirt@okta.com

Description

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Traduire en français

Produits concernés

auth0.js

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	psirt@okta.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-613

Références

https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v
https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories