CVE-2026-85473

A flaw was found in auth0/java-jwt. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a JSON Web Token JWT containing an out-of-range timestamp claim. Because the issue occurs during token parsing before cryptographic signature verification, processing these malforme...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the token parsing process. An attacker can cause the service to terminate threads and degrade availability by submitting JWTs with timestamp claims containing out-of-range values...

ai.expert:nlapi-java-sdk (>=2.6.1, <=2.7.0), ai.jokkoo:jokkoo-server (>=0.1.0, <=1.3.7) +1965 more potentially affected by CVE-2026-85473 via com.auth0:java-jwt (>=4.0.0, <=4.6.1)

com.auth0:java-jwt MAVEN version =4.0.0, =2.6.1, =0.1.0, =0.1.3, =0.1.0, =0.0.0.2-alpha, =0.1.0, =0.1.0-alpha, =5.3.1, =9.2.0, =7.2.0, =9.2.0, =1.1.4.2, =1.1.5 - br.com.sdkopen:security 1.0.0 and more Source cves: CVE-2026-85473 Source advisory: SNYK:JAVA-COMAUTH0-20937619...

CVE-2026-85473

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473

The auth0/java-jwt library is vulnerable to a flaw where it may terminate a thread upon receiving a JSON Web Token (JWT) containing an out-of-range value in timestamp claims such as exp , nbf , or iat . This issue occurs during the token parsing phase, specifically before signature verification t...

CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

cn.net.autocode:autocode-core (1.2.8), cn.net.autocode:autocode-platform (>=2.6.3, <=2.6.8) +347 more potentially affected by CVE-2026-85473 via com.auth0:java-jwt (>=4.6.0, <=4.6.1)

com.auth0:java-jwt MAVEN version =4.6.0, =2.6.3, =5.8.0, =1.3.6, =1.4.2 - com.codeheadsystems:hofmann-dropwizard 3.0.0 - com.codeheadsystems:hofmann-server 3.0.0 - com.codeheadsystems:hofmann-springboot 3.0.0 - com.fonrouge.fslib:fullstack-jvm 6.4.0 - com.fonrouge.fslib:media-jvm 6.4.0 -...

EUVD-2026-100486

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

PT-2026-113389

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473: Improper Handling of Exceptional Conditions

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

java-jwt-4.4.0-1.1 on GA media (moderate)

java-jwt-4.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14395-1 Rating: moderate Cross-References: CVE-2022-42003 CVSS scores: CVE-2022-42003 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

Withdrawn: JJWT improperly generates signing keys

Withdrawn Advisory This advisory has been withdrawn because it has been found to be disputed. Please see the issue here for more information. Original Description JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

Java JWT security vulnerabilities

Java JWT is a jwtk open source JSON web token for Java and Android. A security vulnerability exists in Java JWT JJWT version 0.12.5, which stems from a security issue in the setSigningKey method in the DefaultJwtParser class and in the signWith method in the DefaultJwtBuilder class, which omits...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

The JJWT (Java JWT) library through version 0.12.5 contains a vulnerability where it ignores certain characters, potentially leading users to believe they possess a stronger key than they actually do. This issue affects the setSigningKey() method in the DefaultJwtParser class and the signWith() m...