The node library @twilio-labs/netlify-okta-auth, up to version 1.0.2, does not verify the "iss" claim used to retrieve a public signing key. An attacker who can supply or influence this claim can trick the application into fetching a key from a malicious or unintended source and subsequently validate JSON Web Tokens (JWTs) signed by the attacker. The resulting weakness is an improper restriction of variables (CWE-669) that can lead to unauthorized authentication and potential privilege escalation.

twilio-labs/netlify-okta-auth, versions up to and including 1.0.2

The vulnerability carries a CVSS score of 7.2, indicating a high severity. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves supplying a forged or manipulated "iss" value, or misconfiguring the NOA_OKTA_URL environment variable, leading to an outbound HTTP request that retrieves a key from an attacker-controlled host. Exploitation would grant the attacker the ability to produce valid JWTs that the application will accept, enabling access to protected resources.