Okta

Latest CVEs · RSS

• CVE-2026-85473 2026-10-13 · CVSS 5.3
  The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition oc
• CVE-2026-78633 2026-10-13 · CVSS 6.5
  The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to l
• CVE-2026-78632 2026-10-13 · CVSS 5.3
  The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories contai
• CVE-2026-107371 2026-10-13 · CVSS 5.4
  When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the
• CVE-2026-107370 2026-10-13 · CVSS 5.3
  When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET
• CVE-2026-107369 2026-10-13 · CVSS 6.1
  The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for
• CVE-2026-78628 2026-10-13 · CVSS 6.0
  The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size
• CVE-2026-84685 2026-09-08 · CVSS 6.5
  The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side re
• CVE-2026-85983 2026-09-08 · CVSS 7.8
  The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify th
• CVE-2026-85982 2026-09-08 · CVSS 9.0
  The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log co
• CVE-2026-85981 2026-09-08 · CVSS 6.7
  The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. T
• CVE-2026-78622 2026-09-08 · CVSS 6.0
  The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated priv
• CVE-2026-78631 2026-09-08 · CVSS 5.3
  The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion.
• CVE-2026-78630 2026-09-08 · CVSS 6.7
  The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An
• CVE-2026-78629 2026-09-08 · CVSS 5.6
  The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The
• CVE-2026-78635 2026-09-08 · CVSS 5.0
  The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scale
• CVE-2026-78620 2026-09-08 · CVSS 5.9
  The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the
• CVE-2026-78579 2026-09-08 · CVSS 6.8
  The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration
• CVE-2026-78627 2026-09-08 · CVSS 7.3
  The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the i
• CVE-2026-78574 2026-09-08 · CVSS 7.5
  The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The ref
• CVE-2026-78626 2026-09-08 · CVSS 8.1
  The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an a
• CVE-2026-78625 2026-09-08 · CVSS 6.7
  The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically
• CVE-2026-78624 2026-09-08 · CVSS 4.9
  The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to
• CVE-2026-78560 2026-09-08 · CVSS 4.8
  The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptograp
• CVE-2026-78552 2026-09-08 · CVSS 6.0
  The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly int