CVE-2026-85473: Out-of-Range Timestamp Claim Handling in auth0/java-jwt
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
auth0/java-jwtto a version that resolves this vulnerability.Fixed in 4.6.2
Event History
Frequently Asked Questions
Which services are exposed to this issue?
Services that accept JWTs from network-reachable or otherwise untrusted sources and parse them with auth0/java-jwt are exposed. The malformed timestamp is processed before signature verification, so an attacker does not need a validly signed token.
What does an attacker need to send to trigger the condition?
An attacker needs to submit a JWT containing an out-of-range value in an exp, nbf, or iat timestamp claim. Repeated submissions can degrade service availability by causing thread termination.
Can unsigned or invalidly signed tokens trigger the issue?
Yes. The problematic timestamp handling occurs during parsing before signature verification, so signature validity does not prevent the condition from being reached.