CVE record · 1 source
CVE-2026-111243
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-613
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims.
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still…