AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Packages

Okta security advisories

67 advisories · 13 critical or high in 12 months · latest Oct 22

Advisories page

60 of 67 advisories

High 8.1Oct 22Authentication Source Verification Issue in Okta Access GatewayCVE-2026-115546no fix yetCritical 9.1Oct 22Command Execution via Admin Console Input in Okta Access GatewayCVE-2026-115547no fix yetCritical 9.8Oct 22PHP Runtime Vulnerabilities Affecting Okta Access GatewayCVE-2026-109618no fix yetMedium 6.5Oct 13Denial of Service in Okta RADIUS Agent Packet ParserCVE-2026-78633no fix yetMedium 5.3Oct 13Insecure Default File Permissions in Okta RADIUS Agent Windows InstallerCVE-2026-78632no fix yetMedium 5.3Oct 13Out-of-Range Timestamp Claim Handling in auth0/java-jwtCVE-2026-85473no fix yetMedium 6.1Oct 13Improper Validation of Post-Login Redirect URL in nextjs-auth0CVE-2026-107369no fix yetMedium 5.3Oct 13Improper Request Handling for Active Directory Logins in auth0-lockCVE-2026-107370no fix yetMedium 6.0Oct 13Improper Input Validation in the Okta Credential Provider for WindowsCVE-2026-78628no fix yetMedium 5.4Oct 13Missing Verification of auth_time Claim in auth0.jsCVE-2026-107371no fix yetMedium 6.7Sep 8Okta Auth0 AD/LDAP Connector: missing authenticationCVE-2026-85981no fix yetCritical 9.0Sep 8Okta Auth0 AD/LDAP Connector: cross-site scriptingCVE-2026-85982no fix yetHigh 7.8Sep 8Okta Auth0 AD/LDAP Connector: code executionCVE-2026-85983no fix yetMedium 6.5Sep 8The react-native-auth0 SDK's web platform implementation does not scope its...CVE-2026-84685fixed in 5.11.1Medium 6.0Sep 8Okta Verify for Windows: link followingCVE-2026-78622fixed in 7.0.0Medium 5.6Sep 8The Okta Hyperdrive agent plugin returns a success response without a signed...CVE-2026-78629fixed in 1.5.2Medium 6.7Sep 8Okta Access Gateway: command injectionCVE-2026-78630fixed in 2026.9.1Medium 5.3Sep 8Okta Hyperdrive Agent: information disclosureCVE-2026-78631fixed in 1.5.2Medium 5.0Sep 8Okta Privileged Access Client: argument injectionCVE-2026-78635fixed in 1.113.0High 8.1Sep 8Okta Access Gateway: improper authorizationCVE-2026-78626fixed in 2026.9.1High 7.3Sep 8Okta Hyperdrive Integration Plugin: secrets in logsCVE-2026-78627fixed in 1.5.2High 7.7Sep 8Okta Access Gateway: SQL injectionCVE-2026-78623fixed in 2026.9.1Medium 4.9Sep 8Okta Access Gateway: path traversalCVE-2026-78624fixed in 2026.9.1Medium 6.7Sep 8Okta Access Gateway: code injectionCVE-2026-78625fixed in 2026.9.1Medium 6.0Sep 8Okta Access Gateway: protection mechanism failureCVE-2026-78552fixed in 2026.9.1Medium 4.8Sep 8Okta Access Gateway: improper authenticationCVE-2026-78560fixed in 2026.9.1High 7.5Sep 8Okta Hyperdrive Integration Plugin: untrusted search pathCVE-2026-78574fixed in 1.5.2Medium 6.8Sep 8The Okta Access Gateway does not sanitize SAML assertion attribute values...CVE-2026-78579fixed in 2026.9.1Medium 5.9Sep 8The Okta Access Gateway Kerberos configuration handler does not validate file...CVE-2026-78620fixed in 2026.9.1Medium 6.6Sep 8Okta Access Gateway: code injectionCVE-2026-78545fixed in 2026.9.1Medium 6.6Sep 8Okta Access Gateway: code executionCVE-2026-78550fixed in 2026.9.1Medium 5.3Aug 25Okta Privileged Access Client: command injectionCVE-2026-77585fixed in 1.111.1Medium 6.5Jun 10Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKCVE-2026-50157no fix yetHigh 7.1May 6Improper Permission Checking in Auth0.js SDKCVE-2026-42280no fix yetMedium 5.4Apr 17Improper Proxy Cache Lookup in the Auth0 Next.js SDKCVE-2026-40155no fix yetHigh 8.2Apr 1Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDKCVE-2026-34236no fix yetMedium 5.3Dec 10, 2025Improper Memory Cleanup in the Okta Java SDKCVE-2025-66033no fix yetMedium 5.7Dec 10, 2025Improper Validation of Query Parameters in Auth0 Next.js SDKCVE-2025-67716no fix yetMedium 5.4Dec 10, 2025Improper Request Caching Lookup in the Auth0 Next.js SDKCVE-2025-67490no fix yetHigh 8.4Dec 10, 2025Race condition in the Okta Java SDKCVE-2025-67505no fix yetHigh 7.5Dec 4, 2025Improper HMAC Signature Verification in auth0/node-jwsCVE-2025-65945no fix yetLow 3.3Oct 1, 2025Improper File Type Handling in Bulk User Import in Auth0 Wordpress pluginCVE-2025-58769no fix yetMedium 6.8Jul 22, 2025Okta On-Premises Provisioning (OPP) Password Reset Information DisclosureCVE-2025-7371no fix yetCritical 9.3Jun 3, 2025Deserialization of Untrusted Data in Auth0-PHP SDKCVE-2025-48951no fix yetHigh 7.7Jun 3, 2025CDN Caching of Session Cookies in NextJS-Auth0 SDKCVE-2025-48947no fix yetCritical 9.1May 15, 2025Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKCVE-2025-47275no fix yetCritical 9.3May 6, 2025SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-FedCVE-2025-46572no fix yetHigh 8.6May 6, 2025SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-FedCVE-2025-46573no fix yetMedium 6.9Apr 30, 2025JWT Invalid Signature Validation in Auth0 Account Linking ExtensionsCVE-2025-46345no fix yetHigh 7.1Nov 1, 2024Okta Verify Desktop MFA for Windows Passwordless LoginCVE-2024-9191no fix yetUnscoredNov 1, 2024Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security AdvisoryOKTA-1QNIVM9no fix yetHigh 8.1Oct 24, 2024Okta Verify for iOS ContextExtensionCVE-2024-10327no fix yetUnscoredOct 4, 2024Okta Classic Application Sign-On Policy BypassOKTA-05VHAP4no fix yetMedium 5.5Aug 7, 2024Okta Verify for Windows Privilege EscalationCVE-2024-7061no fix yetHigh 7.1Jul 22, 2024Okta Browser Plugin Reflected Cross-Site ScriptingCVE-2024-0981no fix yetHigh 7.1Mar 26, 2024Okta Verify for Windows Auto-update Arbitrary Code ExecutionCVE-2024-0980no fix yetMedium 6.7Sep 19, 2023Okta LDAP AgentCVE-2023-0392no fix yetHigh 8.8Feb 22, 2023Okta Advanced Server Access ClientCVE-2023-0093no fix yetHigh 7.5Nov 1, 2022Okta Access Gateway AdvisoryCVE-2022-3602no fix yetLow 3.9Sep 1, 2022Okta Active Directory AgentCVE-2022-1697no fix yet
About Okta

Security advisories Okta publishes for its own products.

trust.okta.com/security-advisoriesOkta

Okta elsewhere on Ibis: Quarterly · Paydays · Releases · TechConf