{"id":"CVE-2026-111243","kind":"vulnerability","aliases":["CVE-2026-111243"],"related":[],"title":"MicroProfile JWT: negative clock skew setting disables token expiry checks","description":"A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"A negative clock skew value in MicroProfile JWT configuration is not rejected and turns off validation of token expiration and other time-based claims. An attacker holding an expired token can still authenticate with it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jwt","microprofile","package"],"not_affected_if":["default-config","non-negative-clock-skew"],"how_to_check":"- Look for a MicroProfile JWT clock skew setting (mp.jwt.verify.clock.skew or the equivalent in your runtime) and check whether it is set to a negative value\n- Identify the library or server version in use, for example with `mvn dependency:tree` and look for the MicroProfile JWT implementation","fix":"- Upgrade to version `10.3.0` or `11.0.0-M2`, as stated in the description","status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:24:20+00:00","updated_at":"2026-11-10T16:24:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T16:24:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to version `10.3.0` or `11.0.0-M2`, as stated in the description\n- unknown: the sources do not name the product line that each version belongs to","reach":"network","title":"MicroProfile JWT: negative clock skew setting disables token expiry checks","impact":"high","summary":"A negative clock skew value in MicroProfile JWT configuration is not rejected and turns off validation of token expiration and other time-based claims. An attacker holding an expired token can still authenticate with it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["microprofile","java","jwt"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"expired tokens are accepted, so unauthorized access to protected endpoints","analyst_note":"Confirm the affected Maven artifact and its product line from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111243, since the products field is empty.","how_to_check":"- Look for a MicroProfile JWT clock skew setting (mp.jwt.verify.clock.skew or the equivalent in your runtime) and check whether it is set to a negative value\n- Identify the library or server version in use, for example with `mvn dependency:tree` and look for the MicroProfile JWT implementation\n- unknown: the sources do not name the affected package or its Maven coordinates","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","non-negative-clock-skew"],"who_is_affected":"Applications that validate MicroProfile JWT tokens and have a negative clock skew value configured are exposed, because expiration checks are skipped. Systems using the default or a non-negative clock skew are not described as affected. unknown whether other configurations are impacted.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000781,"input_tokens":4551,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111243':13A,16A '-2026':12A,15A '10.3.0':101C '11.0.0':103C 'attack':47B,82C 'authent':54B,91C 'base':44B,76C 'check':10A 'claim':45B,77C 'clock':4A,23B,59C 'configur':29B,80C 'cve':11A,14A 'disabl':7A,66C 'expir':39B,50B,71C,87C 'expiri':9A 'fix':106C 'hold':48B 'issu':108C 'java':17B 'jwt':2A,18B,28B,58C 'm2':104C 'microprofil':1A,19B,27B,57C 'negat':3A,22B,56C 'packag':20B 'possess':84C 'recommend':96C 'reject':32B,64C 'set':6A,61C 'skew':5A,24B,60C 'still':53B,90C 'time':43B,75C 'time-bas':42B,74C 'token':8A,38B,51B,70C,88C 'turn':34B 'upgrad':98C 'user':94C 'valid':36B,67C 'valu':25B 'version':100C","nicknames":[],"mitigations":[],"who_affected":"Applications that validate MicroProfile JWT tokens and have a negative clock skew value configured are exposed, because expiration checks are skipped. Systems using the default or a non-negative clock skew are not described as affected. unknown whether other configurations are impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","jwt","medium","microprofile","package"],"campaign_type":null,"search_a":"'-111243':13A,16A '-2026':12A,15A 'check':10A 'clock':4A 'cve':11A,14A 'disabl':7A 'expiri':9A 'jwt':2A 'microprofil':1A 'negat':3A 'set':6A 'skew':5A 'token':8A","search_b":"'attack':47B 'authent':54B 'base':44B 'claim':45B 'clock':23B 'configur':29B 'expir':39B,50B 'hold':48B 'java':17B 'jwt':18B,28B 'microprofil':19B,27B 'negat':22B 'packag':20B 'reject':32B 'skew':24B 'still':53B 'time':43B 'time-bas':42B 'token':38B,51B 'turn':34B 'valid':36B 'valu':25B","search_c":"'10.3.0':101C '11.0.0':103C 'attack':82C 'authent':91C 'base':76C 'claim':77C 'clock':59C 'configur':80C 'disabl':66C 'expir':71C,87C 'fix':106C 'issu':108C 'jwt':58C 'm2':104C 'microprofil':57C 'negat':56C 'possess':84C 'recommend':96C 'reject':64C 'set':61C 'skew':60C 'still':90C 'time':75C 'time-bas':74C 'token':70C,88C 'upgrad':98C 'user':94C 'valid':67C 'version':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111243","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}