{"id":"CVE-2026-123010","aliases":["EUVD-2026-117323","GHSA-cc92-p629-wm8f"],"status":"published","title":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an...","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00219,"percentile":0.12499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-669"],"published":"2026-11-05T04:10:37Z","modified":"2026-11-05T21:32:22Z","products":[{"vendor":"twilio-labs","product":"netlify-okta-auth"}],"references":[{"url":"https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46","tags":["product","web"]},{"url":"https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth","tags":["product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cc92-p629-wm8f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123010.json","tags":["advisory"]},{"url":"https://github.com/twilio-labs/netlify-okta-auth","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-123010","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","status":"published","published":"2026-11-05T04:10:37.414Z","modified":"2026-11-09T20:38:44.315Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-09T21:34:55.043741Z"}],"euvd":[{"id":"EUVD-2026-117323","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","status":"published","published":"2026-11-05T04:10:37Z","modified":"2026-11-09T20:38:44Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-09T22:18:21.971974Z"}],"ghsa":[{"id":"GHSA-cc92-p629-wm8f","title":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an...","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","status":"published","published":"2026-11-05T06:34:36Z","modified":"2026-11-05T06:34:44Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-669"],"updated_at":"2026-11-05T06:56:57.728857Z"}],"nvd":[{"id":"CVE-2026-123010","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","status":"published","published":"2026-11-05T05:18:36.383Z","modified":"2026-11-09T22:18:35.633Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-669"],"updated_at":"2026-11-09T23:16:05.167043Z"}],"osv":[{"id":"CVE-2026-123010","description":"@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.","status":"published","published":"2026-11-05T04:10:37.414Z","modified":"2026-11-11T02:30:22.849390054Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-669"],"updated_at":"2026-11-10T10:57:25.458985Z"}]}}