CVE-2026-107371: Missing Verification of auth_time Claim in auth0.js

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-15
Weakness: CWE-613

Description

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Affected products

auth0.js: from 9.12.0 before 10.3.0 — fixed in 10.3.0

How to fix

Upgrade to a fixed version: auth0.js 10.3.0. Check the vendor advisory for mitigations.

References

https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v
https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371

Get alerted when CVE-2026-107371 or the next vulnerability affects your stack