CVE-2026-107371: Missing Verification of auth_time Claim in auth0.js
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
auth0.jsto a version that resolves this vulnerability.Fixed in 10.3.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the Auth0.js library are exposed when they call authorize() with a maxAge parameter and rely on that parameter to require a recent user authentication.
What does an attacker need to exploit this behavior?
The attacker would need an ID token representing an authentication event older than the application's requested maximum age. The issue occurs because the library does not validate the token's auth_time claim against maxAge.
Are applications affected if they do not use maxAge?
The described issue is specific to authorize() calls that include a maxAge parameter. The provided information does not indicate impact for calls without maxAge.