Missing Verification of auth_time Claim in auth0.js CVE-2026-107371 - Oct 13, 2026

Description

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Preconditions

The application passes a per-request maxAge value to authorize(), and
The user's existing authentication is older than the requested maxAge.

Affected product and versions

Customers using auth0.js versions from 9.12.0 to 10.2.1 are affected.

Customer Recommendations

To remediate this vulnerability, upgrade auth.js to version 10.3.0 or greater.

Resolution

The vulnerability is present in auth0.js versions from 9.12.0 to 10.2.1 and is resolved in version 10.3.0.

CVE details

CVE ID	CVE-2026-107371
Published Date	2026-10-13
Vulnerability Type	Authentication Freshness Bypass
CWE	CWE-613 (Insufficient Session Expiration)
CVSS v3	Score: 5.4 Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Missing Verification of auth_time Claim in auth0.js