Vulnerability in Okta Verify For Windows
CVE-2024-9191
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing. Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (13.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 13.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Okta Verify For Windows — versions 5.0.2
- Okta Verify
Weakness classification (CWE)
Public proof-of-concept exploits
References
- trust.okta.com/security-advisories/ (vendor-advisory, Vendor Advisory)
- help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm (Release Notes)
Frequently asked questions
- What is CVE-2024-9191?
- CVE-2024-9191 is a high-severity vulnerability in Okta Verify For Windows, classified under Incorrect Default Permissions. CVSS score: 7.1/10. Published 2024-11-01.
- How severe is CVE-2024-9191?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2024-9191 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.