@TWILIO-LABS/NETLIFY-OKTA-AUTH · CVE-2026-123010 · Package
NO FIX YET
The @twilio-labs/netlify-okta-auth npm package accepts an unverified iss claim and uses it to make an outbound HTTP request for a public signing key. A misconfigured deployment where oktaUrl is not set may have further impacts that the sources do not describe.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Netlify sites that use @twilio-labs/netlify-okta-auth's auth function to log users in through Okta are affected, through version 1.0.2. In the code, the token's unverified iss value picks the URL the function fetches signing keys from. The code only compares the issuer to your Okta URL when oktaUrl is configured, so a site without it appears to accept tokens that an attacker signs with their own key. That is our reading of the code, not a vendor statement. Projects that don't use this package can skip it.
Not affected if oktaurl-configured, package-not-installed
Who cares auth-bypass, netlify, node, npm, okta
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.