Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-85473 EUVD-2026-100486

Out-of-Range Timestamp Claim Handling in auth0/java-jwt

Published Oct 13, 2026 · Updated Oct 16, 2026 · Assigned by Okta

Description

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.

Affected products

VendorProductAffectedFixed
Auth0 java-jwt 4.0.0 – < 4.6.2 4.6.2

References