The vulnerability allows auth0.js to accept an ID token whose authentication time is older than the maximum age requested by the application. This occurs because the authorize() method, when called with a maxAge parameter, fails to verify the auth_time claim in the resulting token, letting a stale authentication event be treated as fresh.

Auth0’s auth0.js library, specifically versions older than 10.3.0, is impacted. Upgrading to version 10.3.0 or newer removes the bug. No other vendors or products are listed as affected.

The CVSS score of 5.4 marks this as moderate severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. The attack surface is limited to applications that rely on the vulnerable auth0.js library; an attacker would need to obtain or craft a stale ID token and rely on an application that does not enforce auth_time verification. Because the flaw is a missing validation rather than an injection or remote code execution, the impact is restricted to authentication freshness rather than a full system compromise.