CyberRota Analysis
AI-GeneratedThe OidcClientCodeRequestFilter contains a flaw in the max_age authentication-freshness check, which results from a unit mismatch and an inverted comparison, allowing sessions of any age to be accepted without proper re-authentication. This vulnerability can undermine step-up authentication policies, posing a significant risk to relying parties that depend on re-authentication for security. Organizations utilizing affected versions should prioritize upgrading to versions 4.2.4, 4.1.9, or 3.6.13 to mitigate this risk.
Original NVD Description
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)