Unverified ISS Claim in Netlify Okta Authentication by Twilio Labs
CVE-2026-123010

7.2HIGH

Key Information:

Vendor

Twilio-labs

Status
Netlify-okta-auth
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123010?

The Netlify Okta Authentication package by Twilio Labs, up to version 1.0.2, suffers from a vulnerability due to an unverified 'iss' claim. This security flaw may allow potential attackers to manipulate outbound HTTP requests intended to retrieve public signing keys, thereby compromising the integrity and authenticity of authentication processes. Additionally, developers who misconfigure the 'oktaUrl' setting may expose their applications to further security risks.

Affected Version(s)

netlify-okta-auth 0 <= 1.0.2

References

https://github.com/twilio-labs/netlify-okta-auth/blob/b9b...
product
https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth
product

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.