AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Companies

Okta security advisories

67 advisories across Okta

Company profile
High 8.1Oct 22Authentication Source Verification Issue in Okta Access GatewayCVE-2026-115546no fix yetCritical 9.1Oct 22Command Execution via Admin Console Input in Okta Access GatewayCVE-2026-115547no fix yetCritical 9.8Oct 22PHP Runtime Vulnerabilities Affecting Okta Access GatewayCVE-2026-109618no fix yetMedium 6.5Oct 13Denial of Service in Okta RADIUS Agent Packet ParserCVE-2026-78633no fix yetMedium 5.3Oct 13Insecure Default File Permissions in Okta RADIUS Agent Windows InstallerCVE-2026-78632no fix yetMedium 5.3Oct 13Out-of-Range Timestamp Claim Handling in auth0/java-jwtCVE-2026-85473no fix yetMedium 6.1Oct 13Improper Validation of Post-Login Redirect URL in nextjs-auth0CVE-2026-107369no fix yetMedium 5.3Oct 13Improper Request Handling for Active Directory Logins in auth0-lockCVE-2026-107370no fix yetMedium 6.0Oct 13Improper Input Validation in the Okta Credential Provider for WindowsCVE-2026-78628no fix yetMedium 5.4Oct 13Missing Verification of auth_time Claim in auth0.jsCVE-2026-107371no fix yetMedium 6.7Sep 8Okta Auth0 AD/LDAP Connector: missing authenticationCVE-2026-85981no fix yetCritical 9.0Sep 8Okta Auth0 AD/LDAP Connector: cross-site scriptingCVE-2026-85982no fix yetHigh 7.8Sep 8Okta Auth0 AD/LDAP Connector: code executionCVE-2026-85983no fix yetMedium 6.5Sep 8The react-native-auth0 SDK's web platform implementation does not scope its...CVE-2026-84685fixed in 5.11.1Medium 6.0Sep 8Okta Verify for Windows: link followingCVE-2026-78622fixed in 7.0.0Medium 5.6Sep 8The Okta Hyperdrive agent plugin returns a success response without a signed...CVE-2026-78629fixed in 1.5.2Medium 6.7Sep 8Okta Access Gateway: command injectionCVE-2026-78630fixed in 2026.9.1Medium 5.3Sep 8Okta Hyperdrive Agent: information disclosureCVE-2026-78631fixed in 1.5.2Medium 5.0Sep 8Okta Privileged Access Client: argument injectionCVE-2026-78635fixed in 1.113.0High 8.1Sep 8Okta Access Gateway: improper authorizationCVE-2026-78626fixed in 2026.9.1High 7.3Sep 8Okta Hyperdrive Integration Plugin: secrets in logsCVE-2026-78627fixed in 1.5.2High 7.7Sep 8Okta Access Gateway: SQL injectionCVE-2026-78623fixed in 2026.9.1Medium 4.9Sep 8Okta Access Gateway: path traversalCVE-2026-78624fixed in 2026.9.1Medium 6.7Sep 8Okta Access Gateway: code injectionCVE-2026-78625fixed in 2026.9.1Medium 6.0Sep 8Okta Access Gateway: protection mechanism failureCVE-2026-78552fixed in 2026.9.1Medium 4.8Sep 8Okta Access Gateway: improper authenticationCVE-2026-78560fixed in 2026.9.1High 7.5Sep 8Okta Hyperdrive Integration Plugin: untrusted search pathCVE-2026-78574fixed in 1.5.2Medium 6.8Sep 8The Okta Access Gateway does not sanitize SAML assertion attribute values...CVE-2026-78579fixed in 2026.9.1Medium 5.9Sep 8The Okta Access Gateway Kerberos configuration handler does not validate file...CVE-2026-78620fixed in 2026.9.1Medium 6.6Sep 8Okta Access Gateway: code injectionCVE-2026-78545fixed in 2026.9.1Medium 6.6Sep 8Okta Access Gateway: code executionCVE-2026-78550fixed in 2026.9.1Medium 5.3Aug 25Okta Privileged Access Client: command injectionCVE-2026-77585fixed in 1.111.1Medium 6.5Jun 10Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKCVE-2026-50157no fix yetHigh 7.1May 6Improper Permission Checking in Auth0.js SDKCVE-2026-42280no fix yetMedium 5.4Apr 17Improper Proxy Cache Lookup in the Auth0 Next.js SDKCVE-2026-40155no fix yetHigh 8.2Apr 1Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDKCVE-2026-34236no fix yetMedium 5.3Dec 10, 2025Improper Memory Cleanup in the Okta Java SDKCVE-2025-66033no fix yetMedium 5.7Dec 10, 2025Improper Validation of Query Parameters in Auth0 Next.js SDKCVE-2025-67716no fix yetMedium 5.4Dec 10, 2025Improper Request Caching Lookup in the Auth0 Next.js SDKCVE-2025-67490no fix yetHigh 8.4Dec 10, 2025Race condition in the Okta Java SDKCVE-2025-67505no fix yetHigh 7.5Dec 4, 2025Improper HMAC Signature Verification in auth0/node-jwsCVE-2025-65945no fix yetLow 3.3Oct 1, 2025Improper File Type Handling in Bulk User Import in Auth0 Wordpress pluginCVE-2025-58769no fix yetMedium 6.8Jul 22, 2025Okta On-Premises Provisioning (OPP) Password Reset Information DisclosureCVE-2025-7371no fix yetCritical 9.3Jun 3, 2025Deserialization of Untrusted Data in Auth0-PHP SDKCVE-2025-48951no fix yetHigh 7.7Jun 3, 2025CDN Caching of Session Cookies in NextJS-Auth0 SDKCVE-2025-48947no fix yetCritical 9.1May 15, 2025Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKCVE-2025-47275no fix yetCritical 9.3May 6, 2025SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-FedCVE-2025-46572no fix yetHigh 8.6May 6, 2025SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-FedCVE-2025-46573no fix yetMedium 6.9Apr 30, 2025JWT Invalid Signature Validation in Auth0 Account Linking ExtensionsCVE-2025-46345no fix yetHigh 7.1Nov 1, 2024Okta Verify Desktop MFA for Windows Passwordless LoginCVE-2024-9191no fix yetUnscoredNov 1, 2024Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security AdvisoryOKTA-1QNIVM9no fix yetHigh 8.1Oct 24, 2024Okta Verify for iOS ContextExtensionCVE-2024-10327no fix yetUnscoredOct 4, 2024Okta Classic Application Sign-On Policy BypassOKTA-05VHAP4no fix yetMedium 5.5Aug 7, 2024Okta Verify for Windows Privilege EscalationCVE-2024-7061no fix yetHigh 7.1Jul 22, 2024Okta Browser Plugin Reflected Cross-Site ScriptingCVE-2024-0981no fix yetHigh 7.1Mar 26, 2024Okta Verify for Windows Auto-update Arbitrary Code ExecutionCVE-2024-0980no fix yetMedium 6.7Sep 19, 2023Okta LDAP AgentCVE-2023-0392no fix yetHigh 8.8Feb 22, 2023Okta Advanced Server Access ClientCVE-2023-0093no fix yetHigh 7.5Nov 1, 2022Okta Access Gateway AdvisoryCVE-2022-3602no fix yetLow 3.9Sep 1, 2022Okta Active Directory AgentCVE-2022-1697no fix yet

The newest 60. Each project page has the full list.

About Okta

Okta, Inc. is an American identity and access management company based in San Francisco. It provides cloud software that helps companies manage and secure user authentication into applications, and for developers to build identity controls into applications, websites, web services, and devices.

Elsewhere on Ibis: Quarterly · Paydays · Releases · TechConf