CVE-2026-123010
Description
A flaw was found in @twilio-labs/netlify-okta-auth. An unauthenticated remote attacker could bypass authentication or cause server-side request forgery by supplying a forged security token. The application trusts an unverified issuer (iss) claim within incoming tokens when sending outbound HTTP requests to retrieve public signing keys. This behavior allows an attacker to direct the application to an arbitrary server to fetch attacker-controlled keys or interact with internal network resources.
Statement
Red Hat rates this vulnerability as Moderate because, although an unauthenticated remote attacker can trigger arbitrary outbound requests or manipulate authentication flow via forged token claims, the affected package is not distributed or supported within core Red Hat enterprise products. Exploitation is confined to specialized serverless applications that implement this third-party Okta integration layer. Standard Red Hat platforms and enterprise authentication stacks do not rely on this component and are not exposed by default.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
