All vulnerabilities
CVE-2026-107371GHSA-42v6-5rcc-mq4v

Missing Verification of auth_time Claim in auth0.js

Auth0 auth0.js
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.3.0Fixed versionCVE List
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 10.3.0auth0.jsCVE List
  • 10.3.0auth0-js, npmGitHubnpm install auth0-js@10.3.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Text from CVE List

Affected versions 2

  • auth0.jsaffected: 9.12.0 before 10.3.0CVE List
  • auth0-js, npm>=9.12.0, <=10.12.1GitHub

References 2