Incorrect default permissions in Okta Verify for Windows
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing. Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Okta Verify for Windows (Okta) Fixed in 5.3.3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9191
- 2026-10-03 Alias added: GHSA-vfhr-8j89-9v9w
References
More Okta Verify vulnerabilities
- TI-2024-06543 Path traversal in Okta Verify for Windows CVSS 3.1HIGH 7.8
Sources
- CVE-2024-9191 · CVE Program
- CVE-2024-9191 · NVD
- FIRST EPSS
- GHSA-vfhr-8j89-9v9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences