Okta
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Okta product.
RSS Feeds for Okta security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Okta products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Okta Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 0 vulnerabilities in Okta. Last year, in 2025 Okta had 2 security vulnerabilities published. Right now, Okta is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 2 | 6.85 |
| 2024 | 2 | 7.80 |
| 2023 | 4 | 6.40 |
| 2022 | 2 | 6.35 |
| 2021 | 1 | 6.70 |
It may take a day or so for new Okta vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Okta Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2025-67505 | Dec 10, 2025 |
Okta Java SDK <20.0.1: ApiClient Race Condition Exposes Request HeadersOkta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one requests response to influence another requests response. This issue is fixed in version 20.0.1. |
|
| CVE-2025-66033 | Dec 10, 2025 |
Okta Java SDK 2124 DoS via thread leakOkta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1. |
|
| CVE-2024-9191 | Nov 01, 2024 |
Okta Verify Agent for Windows: Local Privilege Escalation via OktaDeviceAccessPipeThe Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing. Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected. |
Verify
|
| CVE-2024-7061 | Aug 07, 2024 |
Okta Verify Windows DLL Hijacking Priv Escalation - Fixed 5.0.2Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater. |
Verify
|
| CVE-2023-0392 | Nov 08, 2023 |
Arbitrary Code Exec via Unquoted Path in LDAP Agent Update 5.17The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. |
Ldap Agent
|
| CVE-2021-45094 | Jul 20, 2023 |
Imprivata PAM 2.3.202112051108 XSS VulnerabilityImprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS. |
Imprivata Privileged Access Management
|
| CVE-2023-0093 | Mar 06, 2023 |
Okta ASA Client 1.13.1-1.65.0: Webbrowser Command InjectionOkta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment. |
Advanced Server Access
|
| CVE-2022-3145 | Jan 12, 2023 |
Open Redirect in Okta OIDC Middleware (pre-5.0.0)An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. |
Oidc Middleware
|
| CVE-2022-1697 | Sep 06, 2022 |
Unquoted Service Path in Okta AD Agent Update Service v3.83.11Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation. |
Active Directory Agent
|
| CVE-2022-24295 | Feb 21, 2022 |
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injectionOkta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. |
Advanced Server Access Client Windows
|
| CVE-2021-28113 | Apr 02, 2021 |
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. |
Access Gateway
|