CVE-2026-71575

Summary

The OidcClientCodeRequestFilter had a critical flaw in its authentication freshness check where a milliseconds/seconds unit mismatch and inverted comparison caused it to silently accept sessions of any age, bypassing re-authentication requirements. This vulnerability allows attackers to bypass step-up authentication policies without detection.

Exploitability

Exploitation is difficult to perform directly as it requires a relying party configured with setMaxAgeOffset, but the flaw is silent and doesn't require specific attack payloads or complex interactions.

Blast radius

The impact could be significant for organizations using OIDC-based authentication with re-authentication policies, potentially allowing unauthorized access to protected resources without proper authentication freshness checks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to versions 4.2.4, 4.1.9, or 3.6.13 which fix this issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.