{"id":"CVE-2026-123010","kind":"vulnerability","aliases":["CVE-2026-123010"],"related":[],"title":"Twilio netlify-okta-auth trusts an unverified iss claim in tokens","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","summary":"The @twilio-labs/netlify-okta-auth npm package accepts an unverified iss claim and uses it to make an outbound HTTP request for a public signing key. A misconfigured deployment where oktaUrl is not set may have further impacts that the sources do not describe.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@twilio-labs/netlify-okta-auth","fixed":[],"affected":"<= 1.0.2","ecosystem":"npm"}],"ecosystems":[],"tags":["auth-bypass","netlify","node","npm","okta","package"],"not_affected_if":["oktaurl-configured","package-not-installed"],"how_to_check":"- Run npm ls @twilio-labs/netlify-okta-auth; 1.0.2 and earlier are affected, and no fixed release is known.\n- Check your Netlify auth function (getAuthHandler options) and site environment for oktaUrl or NOA_OKTA_URL. If it is unset, treat the function as exposed.\n- Check outbound requests from the auth function to hosts other than your Okta domain.","fix":null,"status":"open","published_at":"2026-11-05T05:18:36+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","triaged_at":"2026-11-05T05:33:37+00:00","updated_at":"2026-11-05T05:35:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T05:33:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Twilio netlify-okta-auth trusts an unverified iss claim in tokens","impact":"medium","summary":"The @twilio-labs/netlify-okta-auth npm package accepts an unverified iss claim and uses it to make an outbound HTTP request for a public signing key. A misconfigured deployment where oktaUrl is not set may have further impacts that the sources do not describe.","audience":"developers","category":"package","nicknames":[],"who_cares":["netlify","okta","npm","node"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources describe outbound requests and possible misconfiguration impacts","analyst_note":"Find the advisory or upstream commit at the NVD link to confirm the fixed version and the impact of a missing oktaUrl.","how_to_check":"- Check whether the project depends on `@twilio-labs/netlify-okta-auth` in `package.json` or the lockfile.\n- Check the installed version with `npm ls @twilio-labs/netlify-okta-auth`; versions through `1.0.2` are covered.\n- Check whether `oktaUrl` is set in the package configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["package-not-installed"],"who_is_affected":"Teams that use the @twilio-labs/netlify-okta-auth package to verify Okta-issued tokens in a Netlify-hosted app are exposed. The sources say the risk is greater when oktaUrl is not set, but do not describe the exact exploit path. Projects that do not install this package can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000725,"input_tokens":4210,"output_tokens":607,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the advisory or upstream commit at the NVD link to confirm the fixed version and the impact of a missing oktaUrl.","search":"'-123010':15A,18A '-2026':14A,17A '/netlify-okta-auth':22A,35B,78C '1.0.2':80C 'accept':38B 'affect':88C 'auth':5A,24B 'auth-bypass':23B 'bypass':25B 'claim':10A,42B,86C 'cve':13A,16A 'deploy':59B 'describ':74B 'http':50B,91C 'impact':68B,103C 'isn':109C 'iss':9A,41B,85C 'key':56B,98C 'lab':34B,77C 'labs':21A 'make':47B 'may':65B,100C 'misconfigur':58B,106C 'netlifi':3A,26B 'netlify-okta-auth':2A 'node':27B 'npm':28B,36B 'okta':4A,29B 'oktaurl':61B,108C 'outbound':49B,90C 'packag':30B,37B 'public':54B,96C 'reli':81C 'request':51B,92C 'retriev':94C 'set':64B,111C 'sign':55B,97C 'sourc':71B 'token':12A 'trust':6A 'twilio':1A,20A,33B,76C 'twilio-lab':32B,75C 'twilio-labs':19A 'unverifi':8A,40B,84C 'use':44B","nicknames":[],"mitigations":[],"who_affected":"Netlify sites that use @twilio-labs/netlify-okta-auth's auth function to log users in through Okta are affected, through version 1.0.2. In the code, the token's unverified iss value picks the URL the function fetches signing keys from. The code only compares the issuer to your Okta URL when oktaUrl is configured, so a site without it appears to accept tokens that an attacker signs with their own key. That is our reading of the code, not a vendor statement. Projects that don't use this package can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["netlifyoktaauth"],"ptokens":["auth","labs","netlify","okta","twilio"],"labels":["authbypass","high","netlify","node","npm","okta","package"],"campaign_type":null,"first_public_at":"2026-11-05T05:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123010","severity":null,"published_at":"2026-11-05T05:18:36+00:00","modified_at":"2026-11-05T05:18:36+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","fetched_at":"2026-11-05T05:31:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123010:1758","url":"https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts","severity":null,"published_at":"2026-11-05T05:35:21+00:00","modified_at":"2026-11-05T05:35:21+00:00","first_seen_at":"2026-11-05T05:35:21+00:00","fetched_at":"2026-11-05T05:35:21+00:00","note":"No vendor advisory found; read the cited auth.ts at commit b9b160e. Decoded (unverified) iss is used as the JWKS URI base (iss/oauth2/v1/keys) before verification, so the server fetches an attacker-chosen URL. The issuer check is only applied when oktaUrl is set; the code shows no other issuer check. Fix: none found; npm latest is 1.0.2, which is affected. Workaround (OpenCVE, not the vendor): set NOA_OKTA_URL/oktaUrl. Nothing verified: no primary advisory.","cites":["https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts","https://app.opencve.io/cve/CVE-2026-123010","https://github.com/twilio-labs/netlify-okta-auth"]}],"documents":[{"id":73633,"url":"https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts","title":"netlify-okta-auth src/auth.ts (referenced by CVE)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":73634,"url":"https://app.opencve.io/cve/CVE-2026-123010","title":"OpenCVE: CVE-2026-123010","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":73636,"url":"https://github.com/twilio-labs/netlify-okta-auth","title":"twilio-labs/netlify-okta-auth repository","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}