CLEANSTART-2026-WZ01681: max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity
Security vulnerability affects the wso2am package. The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4
Event History
Frequently Asked Questions
What authentication flows are exposed?
The affected check is in OidcClientCodeRequestFilter and concerns OpenID Connect authorization code requests that rely on the max_age authentication-freshness parameter.
What does an attacker need to exploit this issue?
The supplied severity vector indicates network access is sufficient, with low attack complexity and no privileges or user interaction required. The impact includes high confidentiality and integrity impact, with no availability impact.
Is the issue limited to a non-default configuration?
The data does not identify any configuration prerequisite beyond use of the affected max_age authentication-freshness check.
How can I determine whether an environment is affected?
Review whether the deployed cleanstart/wso2am package processes authorization code requests through OidcClientCodeRequestFilter and relies on max_age to require recent user authentication. The provided data does not include affected or fixed version ranges.