Out-of-Range Timestamp Claim Handling in auth0/java-jwt CVE-2026-85473 - Oct 13, 2026
Description
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.
Affected product and versions
Customers using auth0/java-jwt versions 4.0.0 to 4.6.1 are affected.
Preconditions
An application uses the auth0/java-jwt library to parse JWTs received from an external source.
Customer Recommendations
To remediate this vulnerability, upgrade auth0/java-jwt to version 4.6.2 or greater.
Resolution
The vulnerability is present in the auth0/java-jwt library versions 4.0.0 to 4.6.1 and is resolved in version 4.6.2.
CVE details
CVE ID | |
Published Date | 2026-10-13 |
Vulnerability Type | Improper Input Validation / Improper Exception Handling |
CWE | CWE-755 – Improper Handling of Exceptional Conditions CWE-20 – Improper Input Validation |
CVSS v3 | Score: 5.3 Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |