CVE-2026-85473: Improper Handling of Exceptional Conditions in Auth0 java-jwt

The Auth0 java-jwt library versions 4.0.0 up to but not including 4.6.2 improperly handle exceptional conditions when parsing JWT tokens with timestamp claims (exp, nbf, iat) that have out-of-range values. This improper handling causes the termination of a thread during token parsing, which occurs prior to signature verification. Repeated requests with such malformed tokens can lead to degraded service availability. The CVSS 3.1 base score is 5.3, indicating a medium severity denial-of-service impact without confidentiality or integrity loss.

The vulnerability can cause thread termination in applications using the affected java-jwt library versions when processing JWT tokens with invalid timestamp claims. This may lead to degraded availability or denial-of-service conditions in the affected service. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing input validation or filtering to reject JWT tokens with out-of-range timestamp claims before they reach the java-jwt library.