CVE-2026-111243 · Package
NO FIX YET · SEE WHAT TO DO
A negative clock skew value in MicroProfile JWT configuration is not rejected and turns off validation of token expiration and other time-based claims. An attacker holding an expired token can still authenticate with it.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that validate MicroProfile JWT tokens and have a negative clock skew value configured are exposed, because expiration checks are skipped. Systems using the default or a non-negative clock skew are not described as affected. unknown whether other configurations are impacted.
Not affected if default-config, non-negative-clock-skew
Who cares java, jwt, microprofile
mvn dependency:tree and look for the MicroProfile JWT implementation10.3.0 or 11.0.0-M2, as stated in the descriptionA negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.