Vulnerabilities

An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values.

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on.

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute.

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs.

The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure.

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges.

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion.

The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands.

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user.

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments.

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents.

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration.

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property.

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification.

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly con…

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files.

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload.

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation.

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field.

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration.

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session.

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file.

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target.

Okta Java Management SDK facilitates interactions with the Okta management API.

Okta Java Management SDK facilitates interactions with the Okta management API.