CVE-2026-107371: Insufficient Session Expiration in Auth0 auth0.js
Description
CVE-2026-107371 is a medium severity vulnerability in the Auth0 auth0.js library where the authorize() method does not properly validate the auth_time claim in ID tokens against the requested maxAge parameter. This can cause applications to accept ID tokens representing authentication events older than intended, potentially allowing session expiration controls to be bypassed.
CVSS v3.1
Score 5.4medium
Affected software
Auth0
auth0.js
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability occurs because when the authorize() method is called with a maxAge parameter, auth0.js fails to verify that the auth_time claim in the returned ID token meets the maxAge requirement. This insufficient session expiration validation means an application may process an ID token that is older than the requested maximum age, undermining session freshness guarantees.
Potential Impact
An attacker or user could potentially reuse an older ID token beyond the intended session expiration window, which may lead to unauthorized access or session fixation scenarios where the application accepts stale authentication tokens. The impact is limited to confidentiality and integrity with no availability impact, and requires at least low privileges to exploit.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should implement additional server-side validation of the auth_time claim against their own session expiration policies to ensure tokens meet the maxAge requirement.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Okta
- Date Reserved
- 2026-10-07T20:59:27.478Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace95dd2cdf04f656aad84a
Added to database: 10/13/2026, 20:34:37 UTC
Last enriched: 10/13/2026, 22:34:17 UTC
Last updated: 10/14/2026, 01:08:24 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.