---
id: "CVE-2026-123010"
kind: "vulnerability"
aliases: ["CVE-2026-123010"]
title: "Twilio netlify-okta-auth trusts an unverified iss claim in tokens"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@twilio-labs/netlify-okta-auth", "fixed": [], "affected": "<= 1.0.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["auth-bypass", "netlify", "node", "npm", "okta", "package"]
not_affected_if: ["oktaurl-configured", "package-not-installed"]
published_at: "2026-11-05T05:18:36+00:00"
first_seen_at: "2026-11-05T05:31:54+00:00"
updated_at: "2026-11-05T05:35:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123010", "first_seen_at": "2026-11-05T05:31:54+00:00"}, {"source": "analyst", "url": "https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts", "first_seen_at": "2026-11-05T05:35:21+00:00", "cites": ["https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts", "https://app.opencve.io/cve/CVE-2026-123010", "https://github.com/twilio-labs/netlify-okta-auth"]}]
exploit_sources: []
---

# Twilio netlify-okta-auth trusts an unverified iss claim in tokens

The @twilio-labs/netlify-okta-auth npm package accepts an unverified iss claim and uses it to make an outbound HTTP request for a public signing key. A misconfigured deployment where oktaUrl is not set may have further impacts that the sources do not describe.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@twilio-labs/netlify-okta-auth affected <= 1.0.2 fixed no fixed version listed

## How to check

- Run npm ls @twilio-labs/netlify-okta-auth; 1.0.2 and earlier are affected, and no fixed release is known.
- Check your Netlify auth function (getAuthHandler options) and site environment for oktaUrl or NOA_OKTA_URL. If it is unset, treat the function as exposed.
- Check outbound requests from the auth function to hosts other than your Okta domain.

## Timeline

- 2026-11-05T05:31:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123010
- 2026-11-05T05:35:21+00:00 analyst https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts — No vendor advisory found; read the cited auth.ts at commit b9b160e. Decoded (unverified) iss is used as the JWKS URI base (iss/oauth2/v1/keys) before verification, so the server fetches an attacker-chosen URL. The issuer check is only applied when oktaUrl is set; the code shows no other issuer check. Fix: none found; npm latest is 1.0.2, which is affected. Workaround (OpenCVE, not the vendor): set NOA_OKTA_URL/oktaUrl. Nothing verified: no primary advisory.

## Documents

- [describes] netlify-okta-auth src/auth.ts (referenced by CVE) https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts
- [mentions] OpenCVE: CVE-2026-123010 https://app.opencve.io/cve/CVE-2026-123010
- [mentions] twilio-labs/netlify-okta-auth repository https://github.com/twilio-labs/netlify-okta-auth

## From the sources

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_