Okta security advisories

56 advisories · 6 critical or high in 12 months · latest Sep 8

56 advisories

Date	Advisory	Severity	Fixed in
Sep 8	Okta Auth0 AD/LDAP Connector: missing authentication Medium6.7Sep 8 CVE-2026-85981No fix yet	Medium6.7	No fix yet
Sep 8	Okta Auth0 AD/LDAP Connector: cross-site scripting Critical9.0Sep 8 CVE-2026-85982No fix yet	Critical9.0	No fix yet
Sep 8	Okta Auth0 AD/LDAP Connector: code execution High7.8Sep 8 CVE-2026-85983No fix yet	High7.8	No fix yet
Sep 8	The react-native-auth0 SDK's web platform implementation does not scope its... Medium6.5Sep 8 CVE-2026-846855.11.1	Medium6.5	5.11.1
Sep 8	Okta Verify for Windows: link following Medium6.0Sep 8 CVE-2026-786227.0.0	Medium6.0	7.0.0
Sep 8	The Okta Hyperdrive agent plugin returns a success response without a signed... Medium5.6Sep 8 CVE-2026-786291.5.2	Medium5.6	1.5.2
Sep 8	Okta Access Gateway: command injection Medium6.7Sep 8 CVE-2026-786302026.9.1	Medium6.7	2026.9.1
Sep 8	Okta Hyperdrive Agent: information disclosure Medium5.3Sep 8 CVE-2026-786311.5.2	Medium5.3	1.5.2
Sep 8	Okta Privileged Access Client: argument injection Medium5.0Sep 8 CVE-2026-786351.113.0	Medium5.0	1.113.0
Sep 8	Okta Access Gateway: improper authorization High8.1Sep 8 CVE-2026-786262026.9.1	High8.1	2026.9.1
Sep 8	Okta Hyperdrive Integration Plugin: secrets in logs High7.3Sep 8 CVE-2026-786271.5.2	High7.3	1.5.2
Sep 8	Okta Access Gateway: SQL injection High7.7Sep 8 CVE-2026-786232026.9.1	High7.7	2026.9.1
Sep 8	Okta Access Gateway: path traversal Medium4.9Sep 8 CVE-2026-786242026.9.1	Medium4.9	2026.9.1
Sep 8	Okta Access Gateway: code injection Medium6.7Sep 8 CVE-2026-786252026.9.1	Medium6.7	2026.9.1
Sep 8	Okta Access Gateway: protection mechanism failure Medium6.0Sep 8 CVE-2026-785522026.9.1	Medium6.0	2026.9.1
Sep 8	Okta Access Gateway: improper authentication Medium4.8Sep 8 CVE-2026-785602026.9.1	Medium4.8	2026.9.1
Sep 8	Okta Hyperdrive Integration Plugin: untrusted search path High7.5Sep 8 CVE-2026-785741.5.2	High7.5	1.5.2
Sep 8	The Okta Access Gateway does not sanitize SAML assertion attribute values... Medium6.8Sep 8 CVE-2026-785792026.9.1	Medium6.8	2026.9.1
Sep 8	The Okta Access Gateway Kerberos configuration handler does not validate file... Medium5.9Sep 8 CVE-2026-786202026.9.1	Medium5.9	2026.9.1
Sep 8	Okta Access Gateway: code injection Medium6.6Sep 8 CVE-2026-785452026.9.1	Medium6.6	2026.9.1
Sep 8	Okta Access Gateway: code execution Medium6.6Sep 8 CVE-2026-785502026.9.1	Medium6.6	2026.9.1
Aug 25	Okta Privileged Access Client: command injection Medium5.3Aug 25 CVE-2026-775851.111.1	Medium5.3	1.111.1
Jun 10	Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CVE-2026-50157 - Jun... UnratedJun 10 CVE-2026-50157No fix yet	Unrated	No fix yet
May 6	Improper Permission Checking in Auth0.js SDK CVE-2026-42280 - May 6, 2026 UnratedMay 6 CVE-2026-42280No fix yet	Unrated	No fix yet
Apr 17	Improper Proxy Cache Lookup in the Auth0 Next.js SDK CVE-2026-40155 - Apr 17, 2026 UnratedApr 17 CVE-2026-40155No fix yet	Unrated	No fix yet
Apr 1	Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDK CVE-2026-34236 - Apr 1... UnratedApr 1 CVE-2026-34236No fix yet	Unrated	No fix yet
Dec 102025	Improper Memory Cleanup in the Okta Java SDK CVE-2025-66033 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-66033No fix yet	Unrated	No fix yet
Dec 102025	Improper Validation of Query Parameters in Auth0 Next.js SDK CVE-2025-67716 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-67716No fix yet	Unrated	No fix yet
Dec 102025	Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-67490No fix yet	Unrated	No fix yet
Dec 102025	Race condition in the Okta Java SDK CVE-2025-67505 - Dec 10, 2025 UnratedDec 10, 2025 CVE-2025-67505No fix yet	Unrated	No fix yet
Dec 42025	Improper HMAC Signature Verification in auth0/node-jws CVE-2025-65945 - Dec 4, 2025 UnratedDec 4, 2025 CVE-2025-65945No fix yet	Unrated	No fix yet
Oct 12025	Improper File Type Handling in Bulk User Import in Auth0 Wordpress plugin CVE-2025-58769... UnratedOct 1, 2025 CVE-2025-58769No fix yet	Unrated	No fix yet
Jul 222025	Okta On-Premises Provisioning (OPP) Password Reset Information Disclosure CVE-2025-7371... UnratedJul 22, 2025 CVE-2025-7371No fix yet	Unrated	No fix yet
Jun 32025	Deserialization of Untrusted Data in Auth0-PHP SDK CVE-2025-48951 - Jun 3, 2025 UnratedJun 3, 2025 CVE-2025-48951No fix yet	Unrated	No fix yet
Jun 32025	CDN Caching of Session Cookies in NextJS-Auth0 SDK CVE-2025-48947 - Jun 3, 2025 UnratedJun 3, 2025 CVE-2025-48947No fix yet	Unrated	No fix yet
May 152025	Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275... UnratedMay 15, 2025 CVE-2025-47275No fix yet	Unrated	No fix yet
May 62025	SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-Fed... UnratedMay 6, 2025 CVE-2025-46572No fix yet	Unrated	No fix yet
May 62025	SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-Fed... UnratedMay 6, 2025 CVE-2025-46573No fix yet	Unrated	No fix yet
Apr 302025	JWT Invalid Signature Validation in Auth0 Account Linking Extensions CVE-2025-46345 - Apr... UnratedApr 30, 2025 CVE-2025-46345No fix yet	Unrated	No fix yet
Nov 12024	Okta Verify Desktop MFA for Windows Passwordless Login CVE-2024-9191 - Nov 1, 2024 UnratedNov 1, 2024 CVE-2024-9191No fix yet	Unrated	No fix yet
Nov 12024	Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory... UnratedNov 1, 2024 OKTA-1QNIVM9No fix yet	Unrated	No fix yet
Oct 242024	Okta Verify for iOS ContextExtension CVE-2024-10327 - Oct 24, 2024 UnratedOct 24, 2024 CVE-2024-10327No fix yet	Unrated	No fix yet
Oct 42024	Okta Classic Application Sign-On Policy Bypass - Oct 4, 2024 UnratedOct 4, 2024 OKTA-05VHAP4No fix yet	Unrated	No fix yet
Aug 72024	Okta Verify for Windows Privilege Escalation CVE-2024-7061 - Aug 7, 2024 UnratedAug 7, 2024 CVE-2024-7061No fix yet	Unrated	No fix yet
Jul 222024	Okta Browser Plugin Reflected Cross-Site Scripting CVE-2024-0981 - Jul 22, 2024 UnratedJul 22, 2024 CVE-2024-0981No fix yet	Unrated	No fix yet
Mar 262024	Okta Verify for Windows Auto-update Arbitrary Code Execution CVE-2024-0980 - Mar 26, 2024 UnratedMar 26, 2024 CVE-2024-0980No fix yet	Unrated	No fix yet
Sep 192023	Okta LDAP Agent CVE-2023-0392 - Sep 19, 2023 UnratedSep 19, 2023 CVE-2023-0392No fix yet	Unrated	No fix yet
Feb 222023	Okta Advanced Server Access Client CVE-2023-0093 - Feb 22, 2023 UnratedFeb 22, 2023 CVE-2023-0093No fix yet	Unrated	No fix yet
Nov 12022	Okta Access Gateway Advisory for CVE-2022-3602 and CVE-2022-3786 - Nov 1, 2022 UnratedNov 1, 2022 CVE-2022-3602No fix yet	Unrated	No fix yet
Sep 12022	Okta Active Directory Agent CVE-2022-1697 - Sep 1, 2022 UnratedSep 1, 2022 CVE-2022-1697No fix yet	Unrated	No fix yet
Mar 212022	Okta Advanced Server Access Client CVE-2022-1030 - Mar 21, 2022 UnratedMar 21, 2022 CVE-2022-1030No fix yet	Unrated	No fix yet
Feb 172022	Okta Advanced Server Access Client CVE-2022-24295 - Feb 17, 2022 UnratedFeb 17, 2022 CVE-2022-24295No fix yet	Unrated	No fix yet
Jan 262022	Okta RADIUS Server Agent CVE-2021-45105 - Jan 26, 2022 UnratedJan 26, 2022 CVE-2021-45105No fix yet	Unrated	No fix yet
Jan 262022	Okta On-Prem MFA Agent CVE-2021-45046 - Jan 26, 2022 UnratedJan 26, 2022 CVE-2021-45046No fix yet	Unrated	No fix yet
Jan 262022	Okta RADIUS Server Agent CVE-2021-45046 - Jan 26, 2022 UnratedJan 26, 2022 CVE-2021-45046No fix yet	Unrated	No fix yet
Apr 22021	Okta Access Gateway CVE-2021-28113 - Apr 2, 2021 UnratedApr 2, 2021 CVE-2021-28113No fix yet	Unrated	No fix yet

About Okta

Security advisories Okta publishes for its own products.

trust.okta.com/security-advisories Okta

Okta elsewhere on fru.dev: Quarterly · Paydays · Releases · TechConf

Critical advisories by email