---
id: CVE-2026-123010
title: '@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim'
summary: >-
  @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss
  claim. This affects an outbound HTTP request to retrieve a public signing key.
  There may be other impacts in a misconfiguration where oktaUrl isn't set.
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-669
vendor: twilio-labs
product: netlify-okta-auth
affected:
  - netlify-okta-auth <= 1.0.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T04:10:37.414Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123010'
references:
  - url: >-
      https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46
  - url: 'https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.728Z'
---

## Overview

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

## Affected

- `netlify-okta-auth <= 1.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Set NOA_OKTA_URL to a trusted, fixed value and validate the iss claim before any use.