Okta

12 results · Clear filters · Feed

• High 8.1
  CVE-2026-115546

  Authentication Source Verification Issue in Okta Access Gateway

  Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Consol…

  Okta Okta Access Gateway
  Oct 23, 2026
• High 7.3
  CVE-2026-78627

  Improper Credential Protection in Okta Hyperdrive Integration Installer Logging

  The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by…

  Okta Okta Hyperdrive Integration Plugin
  Sep 8, 2026
• High 7.5
  CVE-2026-78574

  Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

  The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverifi…

  Okta Okta Hyperdrive Integration Plugin
  Sep 8, 2026
• High 8.1
  CVE-2026-78626

  Improper Input Sanitization in Okta Access Gateway Protected Rules

  The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one …

  Okta Okta Access Gateway
  Sep 8, 2026
• High 7.7
  CVE-2026-78623

  Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

  The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting…

  Okta Okta Access Gateway
  Sep 8, 2026
• High 8.4
  CVE-2025-67505

  Race condition in the Okta Java SDK

  Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request…

  Okta okta-sdk-java com.okta.sdk:okta-sdk-root Maven
  Dec 10, 2025
• High 7.1
  CVE-2024-9875

  Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerabili…

  Okta Okta Privileged Access Server Agent (SFTD)
  Nov 20, 2024
• High 7.1
  CVE-2024-9191

  The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccess…

  Okta Okta Verify for Windows Windows
  Nov 1, 2024
• High 8.1
  CVE-2024-10327

  A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification resp…

  Okta Okta Verify for iOS iOS
  Oct 24, 2024
• High 7.1
  CVE-2024-0981

  Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. …

  Okta Okta Browser Plugin
  Jul 23, 2024
• High 7.1
  CVE-2024-0980

  The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to ex…

  Okta Okta Verify for Windows Windows
  Mar 27, 2024
• High 8.8
  CVE-2023-0093

  Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third …

  Okta Advanced Server Access
  Mar 6, 2023