CVE-2026-123010

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

• CWE-669

• https://github.com/twilio-labs/netlify-okta-auth/blob/b9b160ec25d5ebff80509cd673f8e67ea6f8c617/src/auth.ts#L38-L46
• https://www.npmjs.com/package/@twilio-labs/netlify-okta-auth

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12298Memory safety bug fixed in Thunderbird 152. This vulnerabili…5.4
• CVE-2026-12299JIT miscompilation in the DOM: Core & HTML component. This v…5.4
• CVE-2026-122992In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6,…9.2
• CVE-2026-1230GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2026-12300Memory safety bug fixed in Thunderbird 152. This vulnerabili…5.3
• CVE-2026-12301Memory safety bug fixed in Thunderbird 152. This vulnerabili…5.3
• CVE-2026-123011STMicroelectronics st-mems-android-linux-sensors-hal before …4.2
• CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in in…7.1
• CVE-2026-123014iTerm2 before 3.7.7beta2 has an argument injection vulnerabi…8.7
• CVE-2026-123017GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to…6.5
• CVE-2026-123018A security flaw has been discovered in eosphoros-ai DB-GPT u…8.3
• CVE-2026-123019A weakness has been identified in eosphoros-ai DB-GPT up to …7.3