{"affected":[{"defaultStatus":"unknown","ecosystem":"npm","packageName":"%40twilio-labs/netlify-okta-auth","product":"netlify-okta-auth","source":"CNA: mitre","vendor":"twilio-labs","versions":[{"lessThanOrEqual":"1.0.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123010","cwes":["CWE-669"],"description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.2,"severity":"high","source":"CNA: mitre","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},{"score":7.2,"severity":"high","source":"NVD: cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793855916383,"publishedAt":1793851837414,"references":[{"source":"CNA: mitre","tags":["product"],"url":"https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46"},{"source":"CNA: mitre","tags":["product"],"url":"https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46"},{"source":"cve@mitre.org","tags":[],"url":"https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth"}],"remediation":[{"kind":"workaround","source":"CNA: mitre","text":"Set NOA_OKTA_URL to a trusted, fixed value and validate the iss claim before any use."}],"revision":"5419a1bdef33274405a853141ce9f2331d5df61a292505af8d73b9ac0d6b7c08","sources":[{"modifiedAt":1793851837414,"name":"CNA: mitre","retrievedAt":1793855395866,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123010"},{"modifiedAt":1793855916383,"name":"NVD","retrievedAt":1793859413890,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123010"}],"ssvc":null,"status":"published","title":"CVE-2026-123010","updatedAt":1793859413890}