netlify-okta-auth relies on unverified iss claim when fetching signing key
A Netlify login add-on could be broken into.
Summary
The netlify-okta-auth package relies on an unverified iss claim when fetching a public signing key. Versions through 1.0.2 are affected, and a missing oktaUrl setting may cause other impacts.
Affected when
- oktaUrl not set (misconfiguration)
What to do
No source names a fixed version. Check that you run a version newer than 1.0.2 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen