CVE-2026-123010: High severity vulnerability

Published Nov 5, 2026

Updated

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

Event History

Nov 5, 2026

CVE Published

via MITRE·04:10 AM

Data Sourced

via MITRE·04:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions make an application exposed to this issue?

Applications using @twilio-labs/netlify-okta-auth through version 1.0.2 are affected. The risk involves the package making an outbound HTTP request to retrieve a public signing key based on an unverified issuer claim.

Does exploiting this require an authenticated user or user interaction?

No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Are deployments with no configured oktaUrl a particular concern?

Yes. The available information notes that there may be additional impacts in a misconfiguration where oktaUrl is not set.

CVE-2026-123010: High severity vulnerability

Event History

Frequently Asked Questions

What conditions make an application exposed to this issue?

Does exploiting this require an authenticated user or user interaction?

Are deployments with no configured oktaUrl a particular concern?

Company

Resources

Contact

Frequently Asked Questions

What conditions make an application exposed to this issue?

Does exploiting this require an authenticated user or user interaction?

Are deployments with no configured oktaUrl a particular concern?