AIKIDO-2026-559346

TL;DR

The entry point is OidcClientCodeRequestFilter, a JAX-RS client filter that relying parties configure with setMaxAgeOffset() to request authentication freshness from an OIDC provider. toCodeRequestState() stores a millisecond based future timestamp in the request state, and validateIdToken() compares the ID token's seconds based auth_time claim against that value with an inverted comparison, so the freshness check always passes and a relying party using setMaxAgeOffset for step up re-authentication accepts a session of any age. The fix stores a seconds based minimum acceptable auth_time, rejects tokens whose auth_time is missing or older than that minimum, and sends max_age as a duration in seconds rather than a timestamp.