CLEANSTART-2026-MU39051: max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity

Q: Which deployments are exposed to this issue?

Deployments using the cleanstart/wso2am package are affected where OIDC authorization code requests rely on the max_age authentication-freshness check in OidcClientCodeRequestFilter.

Q: What does an attacker need to exploit it?

The provided data rates the issue as network-reachable with low attack complexity and no required privileges or user interaction. The vulnerability concerns bypass of the max_age authentication-freshness check.

Q: Does this issue affect confidentiality, integrity, or availability?

The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the wso2am package. The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.

Affected Software

1 affected componentFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-71575

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the cleanstart/wso2am package are affected where OIDC authorization code requests rely on the max_age authentication-freshness check in OidcClientCodeRequestFilter.

What does an attacker need to exploit it?

The provided data rates the issue as network-reachable with low attack complexity and no required privileges or user interaction. The vulnerability concerns bypass of the max_age authentication-freshness check.

Does this issue affect confidentiality, integrity, or availability?

The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.

CLEANSTART-2026-MU39051: max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does this issue affect confidentiality, integrity, or availability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does this issue affect confidentiality, integrity, or availability?