Okta vulnerabilities
We track 13 vulnerabilities in Okta products across 12 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Okta vulnerabilities
- 9.1 Critical severity
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing…
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service accoun
- 8.1 High severity
Okta Access Gateway: Improper Authentication
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console
- 9.9 Critical severity
Okta Access Gateway: Improper Neutralization of Special Elements used in an SQL Command
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting
- 7.2 High severity
Okta Access Gateway: Improper Neutralization of Directives in Dynamically Evaluated Code
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of th
- 7.2 High severity
Okta Access Gateway: Improper Control of Generation of Code
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
- 8.4 High severity
okta-sdk-java: Concurrent Execution using Shared Resource with Improper Synchronization
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’
- 7.1 High severity
Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a…
Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD)
- 7.8 High severity
Okta Verify for Windows: Incorrect Default Permissions
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerabilit
- 8.1 High severity
Okta Verify for iOS: Improper Authentication
A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-pr
- 7.8 High severity
Okta Verify for Windows: Uncontrolled Search Path Element
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.
- 7.1 High severity
Okta Browser Plugin: Improper Neutralization of Input During Web Page Generation
Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape t
- 8.8 High severity
Advanced Server Access: Improper Neutralization of Special Elements used in a Command
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit
- 8.8 High severity
Advanced Server Access Client: Improper Neutralization of Special Elements used in an OS Command
Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host wh