CVE-2026-85473

Executive Summary

CVE-2026-85473 is a denial-of-service vulnerability in the Auth0 java-jwt library that causes thread termination when processing JWTs containing out-of-range timestamp claims (exp, nbf, iat). The flaw occurs during token parsing before signature verification, allowing unauthenticated attackers to trigger repeated thread terminations via crafted JWT requests. Affected organizations running services that use java-jwt for JWT validation may experience degraded availability due to thread pool exhaustion. No public exploit or vendor patch currently exists.

Technical Analysis

The Auth0 java-jwt library is a widely used Java implementation for creating and verifying JSON Web Tokens. During the token parsing phase, the library extracts and processes standard JWT timestamp claims: exp (expiration time), nbf (not before), and iat (issued at). These claims are represented as NumericDate values — the number of seconds since the Unix epoch (1970-01-01T00:00:00Z).

The vulnerability manifests when a timestamp claim contains a value outside the representable range for the underlying Java date/time type used during parsing. When the library attempts to convert or process this out-of-range value, an unhandled condition occurs that results in termination of the executing thread. Critically, this occurs during token parsing — before signature verification is performed. This means an attacker does not need a validly signed token; any well-formed JWT structure with a crafted timestamp claim is sufficient to trigger the condition.

CWE-20 (Improper Input Validation) is the assigned weakness. The library fails to validate that timestamp claim values fall within acceptable bounds before processing them. The NVD description does not specify the exact exception class, the internal method where the failure occurs, or whether the thread dies due to an uncaught exception versus an explicit thread termination mechanism. No public source code diff, commit reference, or proof-of-concept is available at this time.

The attack surface is any network-accessible service that accepts JWTs for authentication or authorization and uses the affected java-jwt library. Common deployment patterns include API gateways, microservices performing token introspection, Spring Security-based applications, and OAuth 2.0 resource servers. Because the parsing occurs pre-verification, the flaw is reachable without any authentication or prior authorization.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects: network-reachable, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and low availability impact. The low availability rating likely accounts for the requirement of repeated requests to cause meaningful service degradation rather than a single-request catastrophic denial of service.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-85473. The following attack chain is inferred from the vulnerability class (improper input validation leading to uncontrolled resource consumption / thread termination) and the NVD description.

Phase 1 — Reconnaissance and Target Identification An attacker identifies a network-accessible service that accepts JWTs for authentication. Common indicators include endpoints returning Authorization: Bearer challenge responses, JWT-formatted tokens in cookies or headers, or services publishing OpenID Connect discovery documents. The attacker confirms the service uses the Auth0 java-jwt library through error message fingerprinting, response header analysis, or knowledge of the target's technology stack.

Phase 2 — Triggering the Flaw The attacker constructs a JWT with a structurally valid header and payload. The payload includes one or more of the timestamp claims exp, nbf, or iat set to a value that falls outside the range the library can process. Because the vulnerability triggers during parsing and before signature verification, the token does not need to be signed with a valid key — the JWT signature segment may be arbitrary or empty. The attacker submits this token to any endpoint that invokes the library's parsing or verification routines.

Phase 3 — Execution and Payload Delivery Each crafted request causes the parsing operation to encounter the out-of-range value and terminate the thread handling that request. Since the failure is pre-verification, no authentication bypass is needed. The attacker sends repeated requests containing the malformed timestamp claim at a rate sufficient to consume the available thread pool. Standard HTTP tooling — custom scripts, Burp Suite Intruder, or similar — can deliver the requests.

Phase 4 — Post-Exploitation Impact As threads are consumed and terminated by the parsing failures, the service's ability to handle legitimate requests degrades. In a thread-per-request model, the thread pool may become exhausted. In reactive or event-loop architectures, the impact may be limited to individual request handling. The NVD description states that "repeated requests of this nature may lead to degraded availability of the affected service." No code execution, data exfiltration, or privilege escalation is possible through this vulnerability — the impact is strictly availability-related.

Constraints: Successful exploitation requires the target to use an affected version of Auth0 java-jwt, the timestamp claim to contain a value specifically outside the representable range, and sufficient request volume to cause observable degradation. The exact boundary values that trigger the condition are not specified in available data.

Impact Assessment

The CVSS 3.1 base score is 5.3 (Medium), with the following subscores:

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions or race windows required.
• Privileges Required (PR:N): No authentication needed — the flaw triggers pre-verification.
• User Interaction (UI:N): No user action required.
• Scope (S:U): Impact confined to the vulnerable component.
• Confidentiality (C:N): No data exposure.
• Integrity (I:N): No data modification.
• Availability (A:L): Low impact — repeated requests needed; single requests cause only individual thread termination.

Business Impact: Services relying on Auth0 java-jwt for JWT validation face potential degradation of authentication operations. In microservice architectures where multiple services share the library, the blast radius can span numerous components. Authentication and authorization endpoints are typically on critical paths — degradation directly affects user access to applications. The thread termination model may leave thread pools in an inconsistent state depending on how the application framework handles thread death.

Affected Systems: Java applications using Auth0 java-jwt for JWT parsing or verification. This includes Spring Boot applications, Java-based API gateways, OAuth 2.0 resource servers, and any JVM-based service performing token validation with the library.

Blast Radius: Organizations with internet-facing services using the library are at highest risk. Internal services requiring an initial foothold for network access present a lower risk. The pre-verification nature of the flaw means no valid credentials or token-signing keys are needed, potentially allowing any internet user to trigger the condition.

Detection Guidance

Sigma Rule

title: Auth0 Java-JWT Out-of-Range Timestamp Claim DoS Attempt
id: 8f3a2c1e-7b4d-4e9f-a1c2-3d5e6f7a8b9c
status: experimental
description: Detects repeated JWT parsing failures potentially indicating CVE-2026-85473 exploitation via out-of-range timestamp claims
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85473
author: Threat Intelligence
date: 2026/01/15
tags:
  - attack.t1499
  - cve.2026.85473
logsource:
  category: application
  product: java
detection:
  selection:
    - message|contains:
        - 'java-jwt'
        - 'com.auth0.jwt'
    - message|contains|all:
        - 'timestamp'
        - 'out of range'
    - message|contains|all:
        - 'JWT'
        - 'parse'
        - 'exception'
  condition: selection
falsepositives:
  - Legitimate malformed tokens from clients with clock skew
  - Development and testing environments
level: medium

YARA Rule

rule CVE_2026_85473_JavaJWT_DoS
{
    meta:
        description = "Detects JWT tokens with out-of-range timestamp claims targeting Auth0 java-jwt"
        author = "Threat Intelligence"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85473"
        severity = "medium"

    strings:
        $jwt_header = "{\"alg\":" ascii nocase
        $exp_claim = "\"exp\":" ascii
        $nbf_claim = "\"nbf\":" ascii
        $iat_claim = "\"iat\":" ascii
        $large_ts = /\d{11,}/ ascii

    condition:
        $jwt_header and any of ($exp_claim, $nbf_claim, $iat_claim) and $large_ts
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85473 Auth0 java-jwt Out-of-Range Timestamp Claim DoS Attempt"; flow:established,to_server; http.header; content:"Authorization"; nocase; http.header; content:"Bearer "; nocase; http.header; pcre:"/Bearer\s+eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+/"; pcre:"/(?:iYXQi|ImV4cCI|Im5iZiIp[^}]*:\s*\d{11,}/"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; sid:202685473; rev:1; reference:cve,2026-85473;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [http.request where http.request.method in ("GET", "POST") and
   http.request.headers contains "Authorization" and
   http.request.headers contains "eyJ" and
   event.outcome == "failure"]
  [http.request where http.request.method in ("GET", "POST") and
   http.request.headers contains "Authorization" and
   http.request.headers contains "eyJ" and
   event.outcome == "failure"]
  [http.request where event.outcome == "failure" and
   http.request.headers contains "eyJ"]

Splunk SPL Query

index=application_logs sourcetype=java_app
("java-jwt" OR "com.auth0.jwt" OR "JWT")
("timestamp" AND ("out of range" OR "parse" OR "exception" OR "DateTimeException"))
| stats count values(message) as messages by src_ip, host
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="cve_2026_85473,java_jwt,dos_attempt,">
  <rule id="100573" level="10" frequency="10" timeframe="60">
    <if_matched_sid>100572</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-85473: Repeated Auth0 java-jwt JWT parsing failures from same source - possible DoS attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos_attempt,</group>
  </rule>
  <rule id="100572" level="3">
    <decoded_as>json</decoded_as>
    <field name="message">java-jwt|com\.auth0\.jwt</field>
    <field name="message">timestamp|exp|nbf|iat</field>
    <field name="message">exception|out of range|parse</field>
    <description>CVE-2026-85473: Auth0 java-jwt token parsing failure with timestamp claim</description>
    <group>java_jwt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. No vendor fix available.

Immediate Mitigations:

1. Input validation at the application layer: Implement a reverse-proxy or API-gateway-level validation that rejects JWT tokens containing timestamp claim values outside a sane range (e.g., reject exp, nbf, or iat values exceeding current time by more than a configured threshold). This must be applied before the token reaches the java-jwt library.
2. Rate limiting: Apply aggressive rate limiting on authentication endpoints that process JWTs. Since exploitation requires repeated requests, rate limiting directly reduces the attack's effectiveness.
3. Web Application Firewall (WAF) rules: Deploy custom WAF rules to detect and block requests bearing JWTs with abnormally large numeric claim values. The Suricata rule above provides a starting point for network-level detection.
4. Thread pool isolation: Ensure JWT parsing occurs in isolated thread pools with circuit-breaker patterns so that thread exhaustion in the JWT parsing path does not degrade unrelated service functions.

Patch/Upgrade Steps: No patch is currently available. Monitor the Auth0 java-jwt GitHub repository and the NVD entry for CVE-2026-85473 for vendor advisories and fixed version releases. When a patch is released, upgrade to the fixed version and verify that the timestamp claim validation logic properly bounds input values.

Long-Term Hardening:

1. Implement defense-in-depth: never allow token parsing to occur without upstream validation of token structure and claim ranges.
2. Adopt fault-tolerant application architecture where individual request handling failures cannot cascade to service-wide degradation.
3. Monitor upstream dependencies for security advisories using automated tooling (Dependabot, OWASP Dependency-Check, Snyk).
4. Conduct regular fuzzing of JWT parsing paths with boundary-value inputs for all numeric claims.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-85473
2. Auth0 java-jwt GitHub Repository: https://github.com/auth0/java-jwt
3. CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
4. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. OWASP JWT Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2026-85473 at this time. CISA KEV status: NOT listed. EPSS score is 0.00318 (23.1st percentile), indicating low predicted exploitation likelihood in the near term.