Auth0 java-jwt CVE-2026-85473

The affected service must use auth0/java-jwt 4.0.0 through versions before 4.6.2 to parse JWTs supplied by the attacker (e.g., tokens accepted from HTTP requests at an authentication or API endpoint). Because the out-of-range timestamp-claim (exp/nbf/iat) fault occurs during parsing PRIOR to signature verification, no valid signature, credentials, or authentication are required (PR:N) and no user interaction is needed. Limiting factors: impact is bounded to single-thread termination per malformed token, so sustained, repeated requests are needed to produce meaningful availability degradation, and the endpoint must actually invoke the vulnerable parsing path on untrusted input; services that do not expose java-jwt parsing to unauthenticated/attacker-controlled tokens are not meaningfully exposed.

This is a moderate, availability-only issue (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity impact. The network vector, low complexity, and lack of required privileges or user interaction mean the trigger is easy to reach remotely and pre-authentication, since the fault occurs during token parsing BEFORE signature verification - an attacker does not need a valid signed token. However, the real-world severity is capped: the CVSS A:L reflects that a single malformed JWT terminates one thread rather than crashing the whole service, and the description itself notes that meaningful impact requires 'repeated requests' to achieve degraded availability. No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit was supplied, so there is no evidence of active or widespread exploitation. The provided 'Information Disclosure' tag directly conflicts with the vector and description (C:N, pure availability flaw) and appears to be a mislabel - treat it as a denial-of-service/availability issue, not disclosure. Overall this is a legitimate but non-urgent patch-on-cycle issue rather than a high-priority emergency; prioritize for services that parse untrusted, attacker-supplied JWTs at scale.

An attacker sends HTTP requests carrying crafted JWTs whose exp, nbf, or iat claims contain out-of-range timestamp values to an endpoint backed by a vulnerable java-jwt version. Because the flaw triggers during parsing before signature verification, no valid signature or authentication is required; each malformed token terminates a processing thread, and sustained request volume progressively degrades service availability. No public exploit code was identified at time of analysis.