{"id":"CVE-2026-71575","published":"2026-10-09T11:17:02.690","lastModified":"2026-10-15T17:17:26.953","description":"The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-613"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/p1r9t4xl8ny7rg8wmj8nrygx35ds6vcs","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/4","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The OidcClientCodeRequestFilter had a critical flaw in its authentication freshness check where a milliseconds/seconds unit mismatch and inverted comparison caused it to silently accept sessions of any age, bypassing re-authentication requirements. This vulnerability allows attackers to bypass step-up authentication policies without detection.","exploitability":"Exploitation is difficult to perform directly as it requires a relying party configured with setMaxAgeOffset, but the flaw is silent and doesn't require specific attack payloads or complex interactions.","blast_radius":"The impact could be significant for organizations using OIDC-based authentication with re-authentication policies, potentially allowing unauthorized access to protected resources without proper authentication freshness checks.","remediation":"Upgrade to versions 4.2.4, 4.1.9, or 3.6.13 which fix this issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","oidc","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:48:28.217Z"}}