CVE-2026-85473

CVSS 5.3 (medium) · published 2026-10-13

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.

Weakness: CWE-20, CWE-755

Source: NVD CVE-2026-85473

References

• https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm
• https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.