CVE-2026-107371

Executive Summary

CVE-2026-107371 is a security flaw in the Auth0 auth0.js library where the authorize() method, when called with a maxAge parameter, fails to validate the auth_time claim within the returned ID token against the specified maximum age. This allows an application to accept an ID token representing an authentication event older than the allowed threshold, potentially enabling unauthorized access if an old token is reused. With a CVSS score of 5.4 (Medium), the vulnerability requires low privileges and no user interaction, impacting confidentiality and integrity to a low degree.

Technical Analysis

The vulnerability resides in the Auth0 JavaScript library (auth0.js), specifically within the authorize() method. When an application requests authentication with a maxAge parameter, it expects the identity provider to enforce a maximum time since the last active authentication. The ID token returned should contain an auth_time claim indicating when the user last authenticated. However, auth0.js does not compare this auth_time claim against the requested maxAge value. Consequently, an application relying on maxAge to enforce re-authentication after a certain period may process an ID token that represents a stale authentication event. This is classified as CWE-613: Insufficient Session Expiration. The attack surface is any application using auth0.js for authentication and passing the maxAge parameter to the authorize() method. The flaw does not require network interception or credential theft; it is a logic error in token validation. An attacker who obtains a valid but old ID token—for example, via token leakage, misconfigured storage, or a compromised client—could present it to the application, which would incorrectly accept it as fresh authentication, bypassing the intended session freshness policy.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a target application that uses Auth0 for authentication and relies on the maxAge parameter in auth0.js to enforce re-authentication (e.g., for sensitive operations). This could be detected by observing the authentication flow or analyzing the client-side code that calls authorize() with maxAge.
2. Triggering the flaw: The attacker needs a valid ID token that was issued after an authentication event older than the maxAge value. Such a token might be obtained through token leakage (e.g., from logs, insecure storage, or referrer headers), or by an insider with access to a previously issued token. The attacker presents this token to the application as part of the authentication response. Because auth0.js fails to validate the auth_time claim against maxAge, the application accepts the token as if it were recently authenticated.
3. Payload/execution method: No malicious payload is required; the attack exploits the missing validation logic. The attacker simply supplies the old ID token to the client application, which processes it without error. The token itself is a standard JWT; no modification is necessary. The vulnerability class is insufficient session expiration validation.
4. Post-exploitation impact: The attacker gains access to the application under the identity associated with the old token. Depending on the application's sensitivity, this could allow unauthorized actions or data access that should have required fresh authentication. The impact is limited to confidentiality and integrity (low), with no availability impact. No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class and description.

Impact Assessment

The CVSS score of 5.4 (Medium) reflects a network-accessible vulnerability with low attack complexity, requiring low privileges and no user interaction. The scope is unchanged, and the impact on confidentiality and integrity is low, with no availability impact. Business impact includes potential unauthorized access to user accounts or sensitive operations if an attacker can obtain an old ID token. The blast radius is limited to applications using auth0.js with maxAge and where token freshness is critical. The EPSS score of 0.00209 (10.2th percentile) suggests a low probability of exploitation in the wild. No evidence of active exploitation or CISA KEV listing.

Detection Guidance

Sigma Rule

title: Auth0.js maxAge Claim Bypass Detection
id: 8f4b2c1e-9a3d-4b7f-8c2e-1d5f6a7b8c9d
status: experimental
description: Detects potential exploitation of CVE-2026-107371 where an ID token with an auth_time older than maxAge is accepted.
author: Threat Intelligence Team
date: 2025-04-09
logsource:
  category: application
  product: auth0
detection:
  selection:
    event: "id_token_validated"
    maxAge: "*"
  condition: selection
  # Note: This rule requires application-level logs that include the auth_time claim and maxAge parameter.
falsepositives:
  - Legitimate tokens that are within maxAge
level: medium

YARA Rule

rule CVE_2026_107371_Auth0_JS_MaxAge_Bypass
{
    meta:
        description = "Detects auth0.js files that may be vulnerable to maxAge claim bypass"
        author = "Threat Intelligence Team"
        date = "2025-04-09"
        reference = "CVE-2026-107371"
        hash = "unknown"
    strings:
        $s1 = "maxAge" ascii wide nocase
        $s2 = "auth_time" ascii wide nocase
        $s3 = "authorize" ascii wide nocase
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107371 Auth0.js maxAge Claim Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/authorize"; http_uri; content:"maxAge"; http_client_body; content:"auth_time"; http_client_body; reference:cve,2026-107371; classtype:attempted-user; sid:1000001; rev:1;)

Elastic Detection

sequence by user.id
  [ authentication where event.action == "user_authentication" and auth0.max_age != null ]
  [ authentication where event.action == "token_validation" and auth0.auth_time < (now() - auth0.max_age) ]

Splunk SPL Query

index=auth0 sourcetype=auth0:logs
| search "maxAge" AND "auth_time"
| eval maxAge_seconds = tonumber(maxAge)
| eval auth_time_epoch = strptime(auth_time, "%Y-%m-%dT%H:%M:%S.%QZ")
| eval current_time = now()
| eval token_age = current_time - auth_time_epoch
| where token_age > maxAge_seconds
| table _time, user, app, maxAge_seconds, token_age

Wazuh OSSEC Rule

<group name="auth0,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">id_token_validated</field>
    <field name="maxAge">\.+</field>
    <description>CVE-2026-107371: Possible Auth0.js maxAge claim bypass - token older than maxAge accepted.</description>
    <mitre>
      <id>T1550</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:
   • Avoid relying solely on the maxAge parameter in auth0.js for enforcing fresh authentication. Implement server-side validation of the auth_time claim in ID tokens against an independent session timeout.
   • Monitor authentication logs for tokens with auth_time older than expected and alert on anomalies.
   • If possible, upgrade to a version of auth0.js that includes a fix, but as no patch is available, consider switching to server-side authentication flows or alternative libraries.
2. Patch/upgrade steps:
   • No official patch is available. Track Auth0 security advisories and update auth0.js as soon as a fix is released.
   • As a workaround, manually validate the auth_time claim in the ID token after receiving it from auth0.js before granting access.
3. Long-term hardening:
   • Enforce session expiration logic on the server side, independent of client-side libraries.
   • Implement short-lived tokens and refresh token rotation.
   • Conduct regular security reviews of authentication flows and third-party dependencies.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107371
• Auth0 Security Advisories: https://auth0.com/security (check for updates)
• CWE-613: Insufficient Session Expiration: https://cwe.mitre.org/data/definitions/613.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• No known threat actor campaigns or exploit-in-the-wild evidence for this CVE as of the report date.