{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123010", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-11-05T04:10:37.072Z", "datePublished": "2026-11-05T04:10:37.414Z", "dateUpdated": "2026-11-09T20:38:44.315Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "packageURL": "pkg:npm/%40twilio-labs/netlify-okta-auth", "product": "netlify-okta-auth", "programFiles": ["src/auth.ts"], "repo": "https://github.com/twilio-labs/netlify-okta-auth", "vendor": "twilio-labs", "versions": [{"lessThanOrEqual": "1.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-05T04:10:37.414Z"}, "references": [{"tags": ["product"], "url": "https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46"}, {"tags": ["product"], "url": "https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth"}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Set NOA_OKTA_URL to a trusted, fixed value and validate the iss claim before any use.<br>"}], "value": "Set NOA_OKTA_URL to a trusted, fixed value and validate the iss claim before any use."}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T20:38:30.549200Z", "id": "CVE-2026-123010", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:38:44.315Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "packageURL": "pkg:npm/%40twilio-labs/netlify-okta-auth", "product": "netlify-okta-auth", "programFiles": ["src/auth.ts"], "repo": "https://github.com/twilio-labs/netlify-okta-auth", "vendor": "twilio-labs", "versions": [{"lessThanOrEqual": "1.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set."}], "id": "CVE-2026-123010", "lastModified": "2026-11-05T05:18:36.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-11-05T05:18:36.383", "references": [{"source": "cve@mitre.org", "url": "https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46"}, {"source": "cve@mitre.org", "url": "https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "@twilio-labs/netlify-okta-auth: @twilio-labs/netlify-okta-auth: Authentication bypass via unverified issuer claim", "id": "2567825", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567825"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-807", "details": ["@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.", "A flaw was found in @twilio-labs/netlify-okta-auth. An unauthenticated remote attacker could bypass authentication or cause server-side request forgery by supplying a forged security token. The application trusts an unverified issuer (iss) claim within incoming tokens when sending outbound HTTP requests to retrieve public signing keys. This behavior allows an attacker to direct the application to an arbitrary server to fetch attacker-controlled keys or interact with internal network resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123010", "public_date": "2026-11-05T04:10:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123010\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123010\nhttps://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46\nhttps://www.npmjs.com/package/@twilio-labs/netlify-okta-auth"], "statement": "Red Hat rates this vulnerability as Moderate because, although an unauthenticated remote attacker can trigger arbitrary outbound requests or manipulate authentication flow via forged token claims, the affected package is not distributed or supported within core Red Hat enterprise products. Exploitation is confined to specialized serverless applications that implement this third-party Okta integration layer. Standard Red Hat platforms and enterprise authentication stacks do not rely on this component and are not exposed by default.", "threat_severity": "Moderate"}