Known Vulnerabilities for products from Okta
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Okta".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-78635 json | Not Provided | 2026-09-08 | 2026-09-10 | |
| CVE-2026-78631 json | The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level o... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78630 json | The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78629 json | Not Provided | 2026-09-08 | 2026-09-10 | |
| CVE-2026-78627 json | The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credentia... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78626 json | The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule aut... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78625 json | Not Provided | 2026-09-08 | 2026-09-10 | |
| CVE-2026-78624 json | The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This ... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78623 json | The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanc... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78622 json | Not Provided | 2026-09-08 | 2026-09-10 | |
| CVE-2026-78620 json | The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writin... | Not Provided | 2026-09-08 | 2026-09-22 |
| CVE-2026-78579 json | The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters ... | Not Provided | 2026-09-08 | 2026-09-23 |
| CVE-2026-78574 json | The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive with... | Not Provided | 2026-09-08 | 2026-09-23 |
| CVE-2026-78560 json | The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supp... | Not Provided | 2026-09-08 | 2026-09-23 |
| CVE-2026-78552 json | The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The... | Not Provided | 2026-09-08 | 2026-09-23 |
| CVE-2026-78550 json | The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated ... | Not Provided | 2026-09-08 | 2026-09-29 |
| CVE-2026-78545 json | The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuratio... | Not Provided | 2026-09-08 | 2026-09-29 |
| CVE-2025-67505 json | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race condi... | Not Provided | 2025-12-10 | 2026-09-25 |
| CVE-2025-66033 json | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific m... | Not Provided | 2025-12-10 | 2026-09-25 |
| CVE-2023-0392 json | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. | 6.7 - MEDIUM | 2023-11-08 | 2023-11-16 |