CVE-2026-123010

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

7.2 HIGHEPSS 0.21%Not in KEVNVD: Received

Last updated: 2026-11-05 05:18 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.2	HIGH	3.1mitre (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Details

CVE ID: CVE-2026-123010
Status: Received
Assigner (CNA): mitre
Published: Nov 5, 2026
Last modified: 2026-11-05 05:18 UTC
Weaknesses: CWE-669 · Incorrect Resource Transfer Between Spheres

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:47 UTC.