https://vulnogram.org/ Most recent CVEs assigned by Okta (okta). https://vulnogram.org/seaview/icons/okta.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-85473 https://vulnogram.org/CVE-2026-85473 The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this natu… Medium Network Exploitable Tue, 13 Oct 2026 20:08:56 GMT https://vulnogram.org/CVE-2026-78633 https://vulnogram.org/CVE-2026-78633 The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentic… Medium Tue, 13 Oct 2026 20:08:40 GMT https://vulnogram.org/CVE-2026-78632 https://vulnogram.org/CVE-2026-78632 The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any lo… Medium Tue, 13 Oct 2026 20:08:32 GMT https://vulnogram.org/CVE-2026-107371 https://vulnogram.org/CVE-2026-107371 When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represent… Medium Tue, 13 Oct 2026 20:08:21 GMT https://vulnogram.org/CVE-2026-107370 https://vulnogram.org/CVE-2026-107370 When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to th… Medium Network Exploitable Tue, 13 Oct 2026 20:08:09 GMT https://vulnogram.org/CVE-2026-107369 https://vulnogram.org/CVE-2026-107369 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers… Medium Network Exploitable Tue, 13 Oct 2026 20:08:00 GMT https://vulnogram.org/CVE-2026-78628 https://vulnogram.org/CVE-2026-78628 The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the cre… Medium Tue, 13 Oct 2026 20:07:37 GMT https://vulnogram.org/CVE-2026-84685 https://vulnogram.org/CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the list… Medium Network Exploitable Tue, 08 Sep 2026 20:18:48 GMT https://vulnogram.org/CVE-2026-85983 https://vulnogram.org/CVE-2026-85983 The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lea… High Tue, 08 Sep 2026 20:18:09 GMT https://vulnogram.org/CVE-2026-85982 https://vulnogram.org/CVE-2026-85982 The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify direct… Critical Tue, 08 Sep 2026 20:17:40 GMT https://vulnogram.org/CVE-2026-85981 https://vulnogram.org/CVE-2026-85981 The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel'… Medium Tue, 08 Sep 2026 20:17:06 GMT https://vulnogram.org/CVE-2026-78622 https://vulnogram.org/CVE-2026-78622 The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion… Medium Tue, 08 Sep 2026 20:16:15 GMT https://vulnogram.org/CVE-2026-78631 https://vulnogram.org/CVE-2026-78631 The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication cred… Medium Tue, 08 Sep 2026 20:15:49 GMT https://vulnogram.org/CVE-2026-78630 https://vulnogram.org/CVE-2026-78630 The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values… Medium Tue, 08 Sep 2026 20:14:52 GMT https://vulnogram.org/CVE-2026-78629 https://vulnogram.org/CVE-2026-78629 The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact… Medium Tue, 08 Sep 2026 20:14:27 GMT https://vulnogram.org/CVE-2026-78635 https://vulnogram.org/CVE-2026-78635 The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI f… Medium Network Exploitable Tue, 08 Sep 2026 20:14:00 GMT https://vulnogram.org/CVE-2026-78620 https://vulnogram.org/CVE-2026-78620 The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written… Medium Tue, 08 Sep 2026 20:13:23 GMT https://vulnogram.org/CVE-2026-78579 https://vulnogram.org/CVE-2026-78579 The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP se… Medium Tue, 08 Sep 2026 20:12:53 GMT https://vulnogram.org/CVE-2026-78627 https://vulnogram.org/CVE-2026-78627 The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are re… High Tue, 08 Sep 2026 20:12:16 GMT https://vulnogram.org/CVE-2026-78574 https://vulnogram.org/CVE-2026-78574 The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an… High Tue, 08 Sep 2026 20:11:43 GMT https://vulnogram.org/CVE-2026-78626 https://vulnogram.org/CVE-2026-78626 The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule polic… High Tue, 08 Sep 2026 20:11:08 GMT https://vulnogram.org/CVE-2026-78625 https://vulnogram.org/CVE-2026-78625 The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of th… Medium Tue, 08 Sep 2026 20:10:43 GMT https://vulnogram.org/CVE-2026-78624 https://vulnogram.org/CVE-2026-78624 The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem. Medium Tue, 08 Sep 2026 20:10:15 GMT https://vulnogram.org/CVE-2026-78560 https://vulnogram.org/CVE-2026-78560 The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream… Medium Network Exploitable Tue, 08 Sep 2026 20:09:46 GMT https://vulnogram.org/CVE-2026-78552 https://vulnogram.org/CVE-2026-78552 The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives… Medium Tue, 08 Sep 2026 20:08:58 GMT https://vulnogram.org/CVE-2026-78623 https://vulnogram.org/CVE-2026-78623 The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation,… High Tue, 08 Sep 2026 20:08:11 GMT https://vulnogram.org/CVE-2026-78550 https://vulnogram.org/CVE-2026-78550 The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privil… Medium Tue, 08 Sep 2026 20:06:27 GMT https://vulnogram.org/CVE-2026-78545 https://vulnogram.org/CVE-2026-78545 The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected direct… Medium Tue, 08 Sep 2026 20:05:36 GMT https://vulnogram.org/CVE-2026-77585 https://vulnogram.org/CVE-2026-77585 The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process. Medium Tue, 25 Aug 2026 20:07:20 GMT https://vulnogram.org/CVE-2025-7371 https://vulnogram.org/CVE-2025-7371 Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and tempo… Medium Tue, 22 Jul 2025 15:49:06 GMT https://vulnogram.org/CVE-2024-9875 https://vulnogram.org/CVE-2024-9875 Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server age… High Wed, 20 Nov 2024 22:23:15 GMT https://vulnogram.org/CVE-2024-9191 https://vulnogram.org/CVE-2024-9191 The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vu… High Fri, 01 Nov 2024 21:21:11 GMT https://vulnogram.org/CVE-2024-10327 https://vulnogram.org/CVE-2024-10327 A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a us… High Network Exploitable Thu, 24 Oct 2024 20:17:59 GMT https://vulnogram.org/CVE-2024-7061 https://vulnogram.org/CVE-2024-7061 Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater. Medium Wed, 07 Aug 2024 16:35:44 GMT https://vulnogram.org/CVE-2024-0981 https://vulnogram.org/CVE-2024-0981 Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properl… High Network Exploitable Tue, 23 Jul 2024 20:49:31 GMT https://vulnogram.org/CVE-2024-0980 https://vulnogram.org/CVE-2024-0980 The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. High Wed, 27 Mar 2024 23:16:37 GMT https://vulnogram.org/CVE-2023-0392 https://vulnogram.org/CVE-2023-0392 The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. Low Wed, 08 Nov 2023 20:37:14 GMT https://vulnogram.org/CVE-2023-0093 https://vulnogram.org/CVE-2023-0093 Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection.… High Network Exploitable Mon, 06 Mar 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-3145 https://vulnogram.org/CVE-2022-3145 An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. Medium Network Exploitable Thu, 12 Jan 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-1697 https://vulnogram.org/CVE-2022-1697 Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Age… Tue, 06 Sep 2022 17:18:50 GMT https://vulnogram.org/CVE-2022-1030 https://vulnogram.org/CVE-2022-1030 Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid targ… Wed, 23 Mar 2022 19:46:14 GMT https://vulnogram.org/CVE-2022-24295 https://vulnogram.org/CVE-2022-24295 Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. Mon, 21 Feb 2022 17:49:32 GMT