Okta
Monthly
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. The leaked OAuth client secret can then be used to authenticate against Okta services outside the local machine, explaining the scope change in the CVSS vector and elevating the effective impact beyond a simple local information disclosure. No public exploit has been identified and the vulnerability is not listed in CISA KEV; Okta has released a patch at version 1.5.2.
Authorization bypass in Okta Access Gateway (all versions before 2026.9.1) allows authenticated network users to circumvent Protected Rule access policies due to improper input sanitization and flawed regular expression evaluation in the authorization check component. When administrators have explicitly configured Protected Rule policies to restrict access to specific application resources, an attacker with low-privilege authentication can craft requests that defeat the policy evaluation, gaining unauthorized high-impact access to confidentiality and integrity of protected resources. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
SQL injection in Okta Access Gateway's advanced mode datastore configuration exposes backend databases to arbitrary query execution by attackers who hold a valid SAML identity. The gateway interpolates SAML assertion attribute values directly into query strings prior to preparation, bypassing parameterization entirely. The CVSS scope change (S:C) reflects that the primary damage accrues to the configured backend database rather than the gateway itself; no public exploit has been identified at time of analysis.
The Okta Hyperdrive Agent plugin improperly implements SAML authentication verification - when an organization's policy exempts a given user from MFA, the agent returns a success response containing only a bare boolean flag rather than a cryptographically signed SAML assertion. The relying application receives an authentication verdict it cannot verify, creating an exploitable integrity gap in the SSO trust chain. Affected versions span 1.2.0 through below 1.5.2; Okta has released a patch and no public exploit has been identified at time of analysis.
Path traversal in Okta Access Gateway's backup restore function (all versions prior to 2026.9.1) allows an authenticated administrator to supply a crafted encrypted backup payload containing a malicious embedded filename, causing the appliance to write file contents to arbitrary locations on its filesystem. Exploitation requires high-privilege administrative access (CVSS PR:H), materially limiting the attacker population to those who have already compromised gateway admin credentials. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available at version 2026.9.1.
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Rated low severity (CVSS 3.9). No vendor patch available.
Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. The leaked OAuth client secret can then be used to authenticate against Okta services outside the local machine, explaining the scope change in the CVSS vector and elevating the effective impact beyond a simple local information disclosure. No public exploit has been identified and the vulnerability is not listed in CISA KEV; Okta has released a patch at version 1.5.2.
Authorization bypass in Okta Access Gateway (all versions before 2026.9.1) allows authenticated network users to circumvent Protected Rule access policies due to improper input sanitization and flawed regular expression evaluation in the authorization check component. When administrators have explicitly configured Protected Rule policies to restrict access to specific application resources, an attacker with low-privilege authentication can craft requests that defeat the policy evaluation, gaining unauthorized high-impact access to confidentiality and integrity of protected resources. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
SQL injection in Okta Access Gateway's advanced mode datastore configuration exposes backend databases to arbitrary query execution by attackers who hold a valid SAML identity. The gateway interpolates SAML assertion attribute values directly into query strings prior to preparation, bypassing parameterization entirely. The CVSS scope change (S:C) reflects that the primary damage accrues to the configured backend database rather than the gateway itself; no public exploit has been identified at time of analysis.
The Okta Hyperdrive Agent plugin improperly implements SAML authentication verification - when an organization's policy exempts a given user from MFA, the agent returns a success response containing only a bare boolean flag rather than a cryptographically signed SAML assertion. The relying application receives an authentication verdict it cannot verify, creating an exploitable integrity gap in the SSO trust chain. Affected versions span 1.2.0 through below 1.5.2; Okta has released a patch and no public exploit has been identified at time of analysis.
Path traversal in Okta Access Gateway's backup restore function (all versions prior to 2026.9.1) allows an authenticated administrator to supply a crafted encrypted backup payload containing a malicious embedded filename, causing the appliance to write file contents to arbitrary locations on its filesystem. Exploitation requires high-privilege administrative access (CVSS PR:H), materially limiting the attacker population to those who have already compromised gateway admin credentials. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available at version 2026.9.1.
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Rated low severity (CVSS 3.9). No vendor patch available.
Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.