Okta security advisories

56 advisories across Okta

Date	Advisory	Severity	Fixed in
Sep 8	Okta Auth0 AD/LDAP Connector: missing authentication Medium6.7Sep 8 CVE-2026-85981No fix yet	Medium6.7	No fix yet
Sep 8	Okta Auth0 AD/LDAP Connector: cross-site scripting Critical9.0Sep 8 CVE-2026-85982No fix yet	Critical9.0	No fix yet
Sep 8	Okta Auth0 AD/LDAP Connector: code execution High7.8Sep 8 CVE-2026-85983No fix yet	High7.8	No fix yet
Sep 8	The react-native-auth0 SDK's web platform implementation does not scope its... Medium6.5Sep 8 CVE-2026-846855.11.1	Medium6.5	5.11.1
Sep 8	Okta Verify for Windows: link following Medium6.0Sep 8 CVE-2026-786227.0.0	Medium6.0	7.0.0
Sep 8	The Okta Hyperdrive agent plugin returns a success response without a signed... Medium5.6Sep 8 CVE-2026-786291.5.2	Medium5.6	1.5.2
Sep 8	Okta Access Gateway: command injection Medium6.7Sep 8 CVE-2026-786302026.9.1	Medium6.7	2026.9.1
Sep 8	Okta Hyperdrive Agent: information disclosure Medium5.3Sep 8 CVE-2026-786311.5.2	Medium5.3	1.5.2
Sep 8	Okta Privileged Access Client: argument injection Medium5.0Sep 8 CVE-2026-786351.113.0	Medium5.0	1.113.0
Sep 8	Okta Access Gateway: improper authorization High8.1Sep 8 CVE-2026-786262026.9.1	High8.1	2026.9.1
Sep 8	Okta Hyperdrive Integration Plugin: secrets in logs High7.3Sep 8 CVE-2026-786271.5.2	High7.3	1.5.2
Sep 8	Okta Access Gateway: SQL injection High7.7Sep 8 CVE-2026-786232026.9.1	High7.7	2026.9.1
Sep 8	Okta Access Gateway: path traversal Medium4.9Sep 8 CVE-2026-786242026.9.1	Medium4.9	2026.9.1
Sep 8	Okta Access Gateway: code injection Medium6.7Sep 8 CVE-2026-786252026.9.1	Medium6.7	2026.9.1
Sep 8	Okta Access Gateway: protection mechanism failure Medium6.0Sep 8 CVE-2026-785522026.9.1	Medium6.0	2026.9.1
Sep 8	Okta Access Gateway: improper authentication Medium4.8Sep 8 CVE-2026-785602026.9.1	Medium4.8	2026.9.1
Sep 8	Okta Hyperdrive Integration Plugin: untrusted search path High7.5Sep 8 CVE-2026-785741.5.2	High7.5	1.5.2
Sep 8	The Okta Access Gateway does not sanitize SAML assertion attribute values... Medium6.8Sep 8 CVE-2026-785792026.9.1	Medium6.8	2026.9.1
Sep 8	The Okta Access Gateway Kerberos configuration handler does not validate file... Medium5.9Sep 8 CVE-2026-786202026.9.1	Medium5.9	2026.9.1
Sep 8	Okta Access Gateway: code injection Medium6.6Sep 8 CVE-2026-785452026.9.1	Medium6.6	2026.9.1
Sep 8	Okta Access Gateway: code execution Medium6.6Sep 8 CVE-2026-785502026.9.1	Medium6.6	2026.9.1
Aug 25	Okta Privileged Access Client: command injection Medium5.3Aug 25 CVE-2026-775851.111.1	Medium5.3	1.111.1
Jun 10	Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CVE-2026-50157 - Jun... UnratedJun 10 CVE-2026-50157No fix yet	Unrated	No fix yet
May 6	Improper Permission Checking in Auth0.js SDK CVE-2026-42280 - May 6, 2026 UnratedMay 6 CVE-2026-42280No fix yet	Unrated	No fix yet
Apr 17	Improper Proxy Cache Lookup in the Auth0 Next.js SDK CVE-2026-40155 - Apr 17, 2026 UnratedApr 17 CVE-2026-40155No fix yet	Unrated	No fix yet
Apr 1	Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDK CVE-2026-34236 - Apr 1... UnratedApr 1 CVE-2026-34236No fix yet	Unrated	No fix yet
Dec 102025	Improper Memory Cleanup in the Okta Java SDK CVE-2025-66033 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-66033No fix yet	Unrated	No fix yet
Dec 102025	Improper Validation of Query Parameters in Auth0 Next.js SDK CVE-2025-67716 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-67716No fix yet	Unrated	No fix yet
Dec 102025	Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-67490No fix yet	Unrated	No fix yet
Dec 102025	Race condition in the Okta Java SDK CVE-2025-67505 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-67505No fix yet	Unrated	No fix yet
Dec 42025	Improper HMAC Signature Verification in auth0/node-jws CVE-2025-65945 - Dec 4, 2025 UnratedDec 4, 2025 CVE-2025-65945No fix yet	Unrated	No fix yet
Oct 12025	Improper File Type Handling in Bulk User Import in Auth0 Wordpress plugin CVE-2025-58769... UnratedOct 1, 2025 CVE-2025-58769No fix yet	Unrated	No fix yet
Jul 222025	Okta On-Premises Provisioning (OPP) Password Reset Information Disclosure CVE-2025-7371... UnratedJul 22, 2025 CVE-2025-7371No fix yet	Unrated	No fix yet
Jun 32025	Deserialization of Untrusted Data in Auth0-PHP SDK CVE-2025-48951 - Jun 3, 2025 UnratedJun 3, 2025 CVE-2025-48951No fix yet	Unrated	No fix yet
Jun 32025	CDN Caching of Session Cookies in NextJS-Auth0 SDK CVE-2025-48947 - Jun 3, 2025 UnratedJun 3, 2025 CVE-2025-48947No fix yet	Unrated	No fix yet
May 152025	Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275... UnratedMay 15, 2025 CVE-2025-47275No fix yet	Unrated	No fix yet
May 62025	SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-Fed... UnratedMay 6, 2025 CVE-2025-46572No fix yet	Unrated	No fix yet
May 62025	SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-Fed... UnratedMay 6, 2025 CVE-2025-46573No fix yet	Unrated	No fix yet
Apr 302025	JWT Invalid Signature Validation in Auth0 Account Linking Extensions CVE-2025-46345 - Apr... UnratedApr 30, 2025 CVE-2025-46345No fix yet	Unrated	No fix yet
Nov 12024	Okta Verify Desktop MFA for Windows Passwordless Login CVE-2024-9191 - Nov 1, 2024 UnratedNov 1, 2024 CVE-2024-9191No fix yet	Unrated	No fix yet
Nov 12024	Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory... UnratedNov 1, 2024 OKTA-1QNIVM9No fix yet	Unrated	No fix yet
Oct 242024	Okta Verify for iOS ContextExtension CVE-2024-10327 - Oct 24, 2024 UnratedOct 24, 2024 CVE-2024-10327No fix yet	Unrated	No fix yet
Oct 42024	Okta Classic Application Sign-On Policy Bypass - Oct 4, 2024 UnratedOct 4, 2024 OKTA-05VHAP4No fix yet	Unrated	No fix yet
Aug 72024	Okta Verify for Windows Privilege Escalation CVE-2024-7061 - Aug 7, 2024 UnratedAug 7, 2024 CVE-2024-7061No fix yet	Unrated	No fix yet
Jul 222024	Okta Browser Plugin Reflected Cross-Site Scripting CVE-2024-0981 - Jul 22, 2024 UnratedJul 22, 2024 CVE-2024-0981No fix yet	Unrated	No fix yet
Mar 262024	Okta Verify for Windows Auto-update Arbitrary Code Execution CVE-2024-0980 - Mar 26, 2024 UnratedMar 26, 2024 CVE-2024-0980No fix yet	Unrated	No fix yet
Sep 192023	Okta LDAP Agent CVE-2023-0392 - Sep 19, 2023 UnratedSep 19, 2023 CVE-2023-0392No fix yet	Unrated	No fix yet
Feb 222023	Okta Advanced Server Access Client CVE-2023-0093 - Feb 22, 2023 UnratedFeb 22, 2023 CVE-2023-0093No fix yet	Unrated	No fix yet
Nov 12022	Okta Access Gateway Advisory for CVE-2022-3602 and CVE-2022-3786 - Nov 1, 2022 UnratedNov 1, 2022 CVE-2022-3602No fix yet	Unrated	No fix yet
Sep 12022	Okta Active Directory Agent CVE-2022-1697 - Sep 1, 2022 UnratedSep 1, 2022 CVE-2022-1697No fix yet	Unrated	No fix yet
Mar 212022	Okta Advanced Server Access Client CVE-2022-1030 - Mar 21, 2022 UnratedMar 21, 2022 CVE-2022-1030No fix yet	Unrated	No fix yet
Feb 172022	Okta Advanced Server Access Client CVE-2022-24295 - Feb 17, 2022 UnratedFeb 17, 2022 CVE-2022-24295No fix yet	Unrated	No fix yet
Jan 262022	Okta RADIUS Server Agent CVE-2021-45105 - Jan 26, 2022 UnratedJan 26, 2022 CVE-2021-45105No fix yet	Unrated	No fix yet
Jan 262022	Okta On-Prem MFA Agent CVE-2021-45046 - Jan 26, 2022 UnratedJan 26, 2022 CVE-2021-45046No fix yet	Unrated	No fix yet
Jan 262022	Okta RADIUS Server Agent CVE-2021-45046 - Jan 26, 2022 UnratedJan 26, 2022 CVE-2021-45046No fix yet	Unrated	No fix yet
Apr 22021	Okta Access Gateway CVE-2021-28113 - Apr 2, 2021 UnratedApr 2, 2021 CVE-2021-28113No fix yet	Unrated	No fix yet

About Okta

Okta, Inc. is an American identity and access management company based in San Francisco. It provides cloud software that helps companies manage and secure user authentication into applications, and for developers to build identity controls into applications, websites, web services, and devices.

Elsewhere on fru.dev: Quarterly · Paydays · Releases · TechConf

Critical advisories by email