CVE-2026-71575

Executive Summary

CVE-2026-71575 is an authentication-freshness enforcement failure in OidcClientCodeRequestFilter, a component of the Spring Security OAuth2 client stack, caused by a milliseconds/seconds unit mismatch combined with an inverted comparison polarity in the max_age check. Any relying party that used setMaxAgeOffset to force re-authentication will silently accept sessions of arbitrary age, defeating step-up authentication and session-freshness policies. No public exploit, PoC, Nuclei template, or CISA KEV entry exists, and no patch has been confirmed by tracked sources.

Technical Analysis

The vulnerability is a logic error in the enforcement of the OpenID Connect max_age authentication-freshness mechanism. max_age is an OIDC request parameter that instructs the OpenID Provider to only issue an ID token if the end-user has been actively authenticated within a specified number of seconds. On the relying party side, OidcClientCodeRequestFilter is responsible for validating that the returned authentication event satisfies the freshness requirement. Where a relying party configures setMaxAgeOffset to add tolerance or to require re-authentication, the filter is intended to compare the age of the current session against the configured max_age bound.

Two independent defects compound here:

1. Unit mismatch (milliseconds vs. seconds). Session age and/or the max_age value are compared in inconsistent units. Because max_age is defined in seconds by the OIDC specification, but the code path treats one operand as milliseconds, the comparison is effectively skewed by a factor of 1000. A stale session of many hours, expressed in seconds, is numerically smaller than a millisecond-denominated bound, making an ancient session appear "fresh."

2. Inverted comparison polarity. Even where units align, the polarity of the comparison is reversed, so the filter evaluates the "is the session too old?" predicate backwards. Sessions that should be rejected as stale are accepted, and the freshness gate collapses to a no-op.

The net effect: the max_age check is inoperative. It does not fail closed. It does not throw. It does not log a rejection. It silently returns a positive result for every session regardless of age. This is the defining characteristic of CWE-613 (Insufficient Session Expiration): an explicit freshness control that is present in configuration but absent in enforcement.

Why this is more than a cosmetic bug. Step-up authentication is a load-bearing control in many architectures. Financial transaction confirmation, administrative console elevation, PII disclosure screens, and MFA re-challenge flows frequently rely on max_age to force a fresh credential presentation before a sensitive operation. When the freshness check silently passes, an attacker who already holds a long-lived session cookie — obtained through prior compromise, a shared workstation, a stolen device, or a stale browser session — can reach the protected resource without ever re-presenting a credential.

Attack surface. The affected code executes on the relying party (the application integrating Spring Security OAuth2 client), not on the OpenID Provider. Exploitation therefore does not require control of the IdP. It requires only that the target application (a) uses OidcClientCodeRequestFilter and (b) has configured setMaxAgeOffset with the intent of enforcing re-authentication. Both conditions are configuration-dependent, meaning affected deployments cannot be enumerated by simple version fingerprinting alone. The filter is typically reachable via the OAuth2 authorization-code callback endpoint on the relying party.

Data limitations. The supplied advisory does not enumerate the exact affected version range, the specific comparison method names beyond setMaxAgeOffset, the file path, or the collision of which operand carries milliseconds. Per accuracy policy, no such specifics are asserted here. The class of flaw and its mechanism are fully described; implementation-level identifiers beyond those quoted above are not available and are not invented.

Exploitation Scenarios

No public PoC is available for CVE-2026-71575. The attack chain below is inferred at the vulnerability-class level from the NVD description. It does not rely on any fabricated endpoint, method, or parameter beyond OidcClientCodeRequestFilter, max_age, and setMaxAgeOffset, all of which appear in the supplied description.

1. Reconnaissance / target identification. The attacker identifies a web application acting as an OIDC relying party. This is observable from redirects to a /authorize-style IdP endpoint, the presence of an authorization-code callback route, and ID-token-bearing cookies or tokens. Presence of OidcClientCodeRequestFilter and use of setMaxAgeOffset cannot be confirmed remotely; the attacker assumes them and probes behaviorally. No public fingerprinting template exists.

2. Triggering the flaw class. The attacker obtains a valid but stale session — one older than the relying party's intended freshness window. Acquisition vectors are outside this CVE: a previously stolen session cookie, a session on a shared or unattended endpoint, or a long-lived session kept alive by the victim. The attacker then drives the application into a code path that is gated on step-up authentication.

3. Execution at the vulnerability-class level. The application is expected to detect that the session exceeds the max_age bound and force re-authentication. Due to the unit mismatch (milliseconds vs. seconds) and inverted polarity, the freshness predicate returns "still fresh" for the stale session. No re-authentication challenge is issued. The attacker proceeds with the privileged operation using only the pre-existing session — no password, no MFA, no fresh token. This is a logic-bypass, not memory corruption or injection; there is no malicious payload to deliver. The "payload" is simply the request to the protected resource carrying the stale session credential.

4. Post-exploitation impact. Successful bypass yields access to whatever the step-up policy was protecting, at the privilege level of the hijacked session. Because the freshness check is silently inoperative, no denial-of-service-style signal (failed logins, MFA prompts, exception stack traces) is generated for defenders to observe. From the application's perspective, everything is nominal. Logged only is a normal, authorized request.

Detection implication. There is no signature for a "malicious input" because there is no malicious input. Effective detection is behavioral: correlating access to step-up-protected functionality against session age and against the absence of a re-authentication event, and hunting for reliance on max_age/max_age_offset configuration across the application fleet.

Impact Assessment

Business impact. This is a silent authentication-control bypass. Applications that use max_age/setMaxAgeOffset to enforce re-authentication before sensitive actions — transaction approval, administrative elevation, regulated-data disclosure, credential changes — lose that guarantee entirely. Because the control fails without error, operators have no inherent signal that their step-up policy has stopped functioning. Regulatory exposure follows where max_age underpins step-up requirements (e.g., strong customer authentication regimes, privileged-access re-verification controls).

Affected systems. Relying-party applications built on the affected Spring Security OAuth2 client versions where setMaxAgeOffset is configured. The OpenID Provider is not the vulnerable component and is not required to be compromised. Confidence in the affected-population size is low: the supplied data does not enumerate affected versions and confirms no patch evidence.

Blast radius. Bounded per-deployment by which flows are gated on session freshness. Where max_age protects a small number of sensitive actions, impact is scoped but high-severity per action. Where it is used as a general session-age hygiene control, impact approaches "all authenticated sessions are treated as fresh," effectively disabling the freshness dimension of session management.

CVSS subscores. No vendor-assigned CVSS score or vector was supplied (score: N/A); the vector provided in METADATA is an analyst-derived estimate and should be treated as such, not as a vendor or NVD rating. The estimate reflects network reachability, low attack complexity, no required privileges beyond an existing session, no user interaction specific to triggering the flaw, and limited confidentiality/integrity impact with no availability impact. Organizations should re-score against their own deployment context pending an authoritative vector.

Exploitability. No public exploit, PoC, or Nuclei template is known, and there is no CISA KEV listing. Exploitation requires a pre-existing stale session, which raises the practical bar above purely unauthenticated RCE-style bugs. This is a genuine but secondary control-bypass: it is most dangerous in defense-in-depth architectures where session freshness is the last barrier protecting a high-value action.

Detection Guidance

Because this is a logic defect with no malicious payload, the following rules are best-effort proxies. They target observable behavior of step-up-gated flows and deployment-level configuration posture, not a wire signature. All fields and parameters referenced are limited to max_age, max_age_offset, and OIDC authorization-code flow concepts; no invented endpoints are used.

Sigma Rule

title: OIDC Step-Up Gate Accessed Without Fresh Re-Authentication (CVE-2026-71575)
id: 7f3c1a92-5b4e-4c8d-9a21-0c6e2d5f8b14
status: experimental
description: Detects access to step-up-protected resources by sessions that exceed the configured max_age freshness bound, indicating a possible bypass of the authentication-freshness check in OidcClientCodeRequestFilter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-71575
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: java
detection:
  selection_gated:
    http.method: 'POST'
  selection_sensitive:
    http.url|contains:
      - '/admin'
      - '/transfer'
      - '/confirm'
      - '/settings/security'
  selection_stale:
    session_age_seconds|gt: 900
  selection_no_reauth:
    reauthentication_event: 'false'
  condition: selection_gated and selection_sensitive and selection_stale and selection_no_reauth
falsepositives:
  - Long-lived legitimate sessions where max_age enforcement is intentionally disabled
  - Applications that track session age in a field unavailable to the log pipeline
level: high
tags:
  - attack.t1190
  - cwe.613

YARA Rule

rule CVE_2026_71575_OIDC_MaxAge_Check_Logic_Flaw
{
    meta:
        description = "Hunts configuration and log artifacts indicating use of setMaxAgeOffset / max_age freshness enforcement in OIDC clients potentially affected by CVE-2026-71575. Logic flaw is not detectable by static string match; this rule identifies deployments requiring verification."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-71575"
        cve = "CVE-2026-71575"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $oidc_a = "OidcClientCodeRequestFilter" ascii wide
        $oidc_b = "setMaxAgeOffset" ascii wide
        $oidc_c = "max_age" ascii wide
        $oidc_d = "maxAge" ascii wide

    condition:
        filesize < 5MB and
        (
            ($oidc_b and $oidc_c) or
            ($oidc_a and $oidc_b) or
            ($oidc_a and $oidc_c)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-71575 Possible OIDC max_age Freshness Check Bypass - Step-Up Gated Access"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin"; http.header; content:"Cookie"; reference:cve,2026-71575; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-71575; classtype:policy-violation; sid:2026715751; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-71575 OIDC Authorization Request With max_age Parameter Observed"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"response_type=code"; http.uri; content:"max_age="; reference:cve,2026-71575; classtype:policy-violation; sid:2026715752; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30m
  [authentication where event.action == "user_authentication" and
     event.outcome == "success" and oidc.max_age > 0]
  [http where http.request.method == "POST" and
     http.request.body.bytes > 0 and
     /* access to step-up-protected route */ 
     wildcard(http.request.path, "/admin*", "/transfer*", "/confirm*")]

Splunk SPL Query

index=web OR index=oidc sourcetype IN ("access_combined","spring:security")
| eval sess_age_sec = now() - session_start_time
| where (uri_path LIKE "/admin%" OR uri_path LIKE "/transfer%" OR uri_path LIKE "/confirm%" OR uri_path LIKE "/settings/security%")
| where sess_age_sec > max_age_configured
| where isnull(reauth_event) OR reauth_event="false"
| stats count min(sess_age_sec) AS oldest_session_sec max(sess_age_sec) AS newest_session_sec values(user) AS users by src_ip, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="cve,cve_2026_71575,oidc,authentication,">
  <rule id="202671575" level="12">
    <if_sid>31100</if_sid>
    <field name="url">/admin|/transfer|/confirm|/settings/security</field>
    <field name="http_method">POST</field>
    <description>CVE-2026-71575: Step-up protected resource accessed by session exceeding max_age without fresh re-authentication (possible OIDC freshness bypass).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_71575,pci_dss_10.2.5,gdpr_IV_35.7.d,</group>
  </rule>

  <rule id="202671576" level="6">
    <if_sid>31100</if_sid>
    <field name="url">max_age=</field>
    <description>CVE-2026-71575: OIDC authorization request carrying max_age parameter; verify relying-party freshness enforcement is effective.</description>
    <group>cve_2026_71575,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version enumeration was supplied. The vendor advisory text recommends upgrading to versions 4.2.4, 4.1.9, or 3.6.13; these are the versions named in the description, but no patch artifact, commit, or release note was verified by tracked sources at the time of writing.

1) Immediate mitigations (before upgrade):

• Inventory every relying-party application using OidcClientCodeRequestFilter and setMaxAgeOffset, and determine precisely which sensitive operations depend on max_age for re-authentication.
• Where feasible, compensate for the inoperative freshness check with an independent control: server-side absolute session timeout, forced re-authentication at the application layer immediately before high-value actions (a re-challenge that does not rely on the OIDC max_age path), or a shorter global session lifetime.
• Recognize that removing setMaxAgeOffset does not "fix" the check — it removes reliance on a control that is already silently failing. Treat every freshness-gated flow as unprotected until the underlying filter is corrected.
• Increase monitoring on step-up-gated routes (see Detection Guidance) to establish a baseline and detect anomalous stale-session access.

2) Patch / upgrade steps:

• Upgrade the affected Spring Security OAuth2 client component to 4.2.4, 4.1.9, or 3.6.13, selecting the branch matching your current major/minor line. Apply on a staging environment first.
• After upgrade, explicitly validate the fix: force a session beyond the configured max_age and confirm that the step-up re-authentication challenge is now issued and that stale sessions are rejected.
• Since the advisory indicates the defect is a unit/polarity error, verify the corrected behavior at boundary conditions — sessions just under and just over the freshness window — to confirm no off-by-1000 skew or inverted result remains.
• Track the upstream project's security advisories and the NVD entry for an authoritative CVSS vector and any confirmation of patch artifacts.

3) Long-term hardening:

• Do not treat OIDC max_age as a sole control for privileged operations. Enforce defense-in-depth: independent server-side session aging, re-authentication tokens scoped to the specific sensitive action, and authorization checks that do not assume session freshness.
• Add unit and integration tests asserting that freshness checks fail closed — that a stale session is rejected by default — to prevent regression and to catch polarity/unit errors at CI time.
• Standardize on explicit, well-typed time units across the authentication codebase (e.g., a single duration type) to eliminate seconds/milliseconds ambiguity classes of bugs.
• Maintain an SBOM and dependency monitoring for the OAuth2/OIDC client libraries so future advisories in this component are detected promptly.
• Include nested/third-party security control logic in periodic adversarial review; configuration flags that exist but are never asserted to be effective are a recurring source of silent control failure.

References

• NVD — CVE-2026-71575: https://nvd.nist.gov/vuln/detail/CVE-2026-71575
• MITRE CWE-613 — Insufficient Session Expiration: https://cwe.mitre.org/data/definitions/613.html
• OpenID Connect Core 1.0 — max_age request parameter (authentication freshness semantics): https://openid.net/specs/openid-connect-core-1_0.html
• Spring Security OAuth2 Client project documentation and security advisories: https://spring.io/projects/spring-security
• CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-71575 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaign, exploit-in-the-wild evidence, public PoC, Nuclei template, or EPSS score is associated with CVE-2026-71575 at the time of writing. Exploitability assessment is limited to the vulnerability-class reasoning above.