@twilio-labs/netlify-okta-auth versions through 1.0.2 have a vulnerability where the iss (issuer) claim is not properly verified. This flaw affects the process of making an outbound HTTP request to retrieve a public signing key and may lead to additional impacts if the oktaUrl configuration is missing or incorrect.