Okta
17 CVEs across 21 Okta products. Browse Okta vulnerabilities, severities, and proof-of-concept exploits.
Okta products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67505 | High | 8.4 | 2025-12-10 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent re… |
CVE-2025-66033 | Medium | 5.3 | 2025-12-10 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may e… |
CVE-2025-7371 | Medium | 6.8 | 2025-07-22 | Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with acc… |
CVE-2024-9875 | High | 7.1 | 2024-11-21 | Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature… |
CVE-2024-9191 | High | 7.1 | 2024-11-01 | The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compr… |
CVE-2024-10327 | High | 8.1 | 2024-10-24 | A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension f… |
CVE-2024-7061 | Medium | 5.5 | 2024-08-07 | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To re… |
CVE-2024-0981 | High | 7.1 | 2024-07-23 | Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompt… |
CVE-2024-0980 | High | 7.1 | 2024-03-28 | The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. |
CVE-2023-0392 | Medium | 6.7 | 2023-11-08 | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. |
CVE-2021-45094 | Medium | 5.4 | 2023-07-20 | Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS. |
CVE-2023-0093 | High | 8.8 | 2023-03-06 | Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated li… |
CVE-2022-3145 | Medium | 4.7 | 2023-01-12 | An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. |
CVE-2022-1697 | Low | 3.9 | 2022-09-06 | Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerabil… |
CVE-2022-1030 | High | 8.8 | 2022-03-23 | Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An… |
CVE-2022-24295 | High | 8.8 | 2022-02-21 | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. |
CVE-2021-28113 | Medium | 6.7 | 2021-04-02 | A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to… |