AIKIDO-2026-609248

TL;DR

When session auth-context reuse is enabled, the gateway computes the reuse expiry from a fixed TTL and ignores the JWT exp claim. An expired token remains accepted for the duration of the configured reuse window. This creates an authentication window in which expired credentials continue to authenticate requests. The fix follows the token expiration when caching and reusing the authentication context.