CVE-2026-123010 PUBLISHED

Assigner: mitre
Reserved: 05.11.2026 Published: 05.11.2026 Updated: 05.11.2026

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 7.2

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	twilio-labs
Product	netlify-okta-auth
Versions	Default: unknown affected from 0 to 1.0.2 (incl.)

Workarounds

Set NOA_OKTA_URL to a trusted, fixed value and validate the iss claim before any use.

References

https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46
https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth

Problem Types

CWE-669 Incorrect Resource Transfer Between Spheres CWE