{"resultsPerPage":48,"startIndex":0,"totalResults":48,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-13T11:07:32.692","vulnerabilities":[{"cve":{"id":"CVE-2022-24295","sourceIdentifier":"psirt@okta.com","published":"2022-02-21T18:15:09.187","lastModified":"2026-06-17T04:31:34.003","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL."},{"lang":"es","value":"Se ha detectado que Okta Advanced Server Access Client para Windows versiones anteriores a 1.57.0, es vulnerable a una inyección de comandos por medio de una URL especialmente diseñada"}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Advanced Server Access Client","versions":[{"version":"Prior to version 1.57.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:advanced_server_access_client_for_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"1.57.0","matchCriteriaId":"18F7E188-AC50-46ED-8CA3-FF8C77DD8273"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295","source":"psirt@okta.com","tags":["Vendor Advisory"]},{"url":"https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-1030","sourceIdentifier":"psirt@okta.com","published":"2022-03-23T20:15:10.757","lastModified":"2026-06-17T04:21:40.387","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute commands on the local system."},{"lang":"es","value":"Se ha detectado que el cliente de acceso al servidor avanzado de Okta para Linux y macOS versiones anteriores a 1.58.0, era vulnerable a una inyección de comandos por medio de una URL especialmente diseñada. Un atacante, que presenta conocimiento de un nombre de equipo válido para la víctima y también conoce un host de destino válido donde el usuario presenta acceso, puede ejecutar comandos en el sistema local"}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Advanced Server Access Client","versions":[{"version":"Prior to version 1.58.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:advanced_server_access:*:*:*:*:*:*:*:*","versionEndExcluding":"1.58.0","matchCriteriaId":"94D9EAFF-4B41-400F-9A5E-9AEF46C36EB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"},{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030","source":"psirt@okta.com","tags":["Vendor Advisory"]},{"url":"https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-1697","sourceIdentifier":"psirt@okta.com","published":"2022-09-06T18:15:10.493","lastModified":"2026-06-17T04:22:56.347","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation."},{"lang":"es","value":"Las versiones 3.8.0 a 3.11.0 del Agente de Okta Active Directory instalan el Servicio de Actualización del Agente de Okta AD utilizando una ruta no citada. Nota: Para corregir esta vulnerabilidad, debe desinstalar el Agente de Okta Active Directory y volver a instalar el Agente de Okta Active Directory 3.12.0 o superior según la documentación"}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Active Directory Agent","versions":[{"version":"3.8.0, 3.9.0, 3.10.0, 3.11.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":3.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.5,"impactScore":3.4}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-428"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:active_directory_agent:3.8.0:*:*:*:*:*:*:*","matchCriteriaId":"442B7B70-70D7-488D-BAC4-7B060CCB1388"},{"vulnerable":true,"criteria":"cpe:2.3:a:okta:active_directory_agent:3.9.0:*:*:*:*:*:*:*","matchCriteriaId":"E0B869CF-7CFB-4288-B21B-C959136BE293"},{"vulnerable":true,"criteria":"cpe:2.3:a:okta:active_directory_agent:3.10.0:*:*:*:*:*:*:*","matchCriteriaId":"07931E64-69B0-4081-99A8-9FF8E6989E2C"},{"vulnerable":true,"criteria":"cpe:2.3:a:okta:active_directory_agent:3.11.0:*:*:*:*:*:*:*","matchCriteriaId":"C8403CAC-AA6E-4B65-B02D-0DA097D9E53B"}]}]}],"references":[{"url":"https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm","source":"psirt@okta.com","tags":["Vendor Advisory"]},{"url":"https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ","source":"psirt@okta.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697","source":"psirt@okta.com","tags":["Vendor Advisory"]},{"url":"https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-3145","sourceIdentifier":"psirt@okta.com","published":"2023-01-12T19:15:24.007","lastModified":"2026-06-17T04:58:57.070","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL."},{"lang":"es","value":"Existe una vulnerabilidad de redireccionamiento abierto en Okta OIDC Middleware anterior a la versión 5.0.0 que permite a un atacante redirigir a un usuario a una URL arbitraria."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta OIDC Middleware","versions":[{"version":"prior to 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-08T13:36:52.687825Z","id":"CVE-2022-3145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:oidc_middleware:*:*:*:*:*:node.js:*:*","versionEndExcluding":"5.0.0","matchCriteriaId":"A718D4D7-985F-466E-B29B-E9315F373B7F"}]}]}],"references":[{"url":"https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4","source":"psirt@okta.com","tags":["Third Party Advisory"]},{"url":"https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-0093","sourceIdentifier":"psirt@okta.com","published":"2023-03-06T21:15:10.933","lastModified":"2026-06-17T05:24:45.880","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Advanced Server Access","versions":[{"version":"1.13.1 through 1.65.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-06T19:39:33.009371Z","id":"CVE-2023-0093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-77"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:advanced_server_access:*:*:*:*:*:*:*:*","versionStartIncluding":"1.13.1","versionEndExcluding":"1.68.2","matchCriteriaId":"8246431D-FAFE-428E-BBC0-8AEBDEE2F1D8"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/","source":"psirt@okta.com","tags":["Vendor Advisory"]},{"url":"https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2023-0392","sourceIdentifier":"psirt@okta.com","published":"2023-11-08T21:15:08.353","lastModified":"2026-06-17T05:25:26.100","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution."},{"lang":"es","value":"El servicio LDAP Agent Update con versiones anteriores a la 5.18 utilizaba una ruta sin comillas, lo que podía permitir la ejecución de código arbitrario."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"LDAP Agent","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.18","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"okta","product":"ldap_agent","defaultStatus":"unknown","cpes":["cpe:2.3:a:okta:ldap_agent:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"5.18","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":3.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.5,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-04T16:02:43.869848Z","id":"CVE-2023-0392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-428"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-428"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-428"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:ldap_agent:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18","matchCriteriaId":"46817F73-3816-44BE-9F93-37236FF534B6"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392","source":"psirt@okta.com","tags":["Vendor Advisory"]},{"url":"https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-0980","sourceIdentifier":"psirt@okta.com","published":"2024-03-28T00:15:07.867","lastModified":"2026-06-17T06:54:41.683","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code."},{"lang":"es","value":"El servicio de actualización automática de Okta Verify para Windows es vulnerable a dos fallas que, en combinación, podrían usarse para ejecutar código arbitrario."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Verify for Windows","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.10.7","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"okta","product":"verify","defaultStatus":"unknown","cpes":["cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"4.10.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-03-30T04:00:54.049277Z","id":"CVE-2024-0980","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-427"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2024-0981","sourceIdentifier":"psirt@okta.com","published":"2024-07-23T21:15:12.773","lastModified":"2026-06-17T06:54:41.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox."},{"lang":"es","value":"Las versiones 6.5.0 a 6.31.0 de Okta Browser Plugin (Chrome/Edge/Firefox/Safari) son vulnerables a Cross Site Scripting. Este problema ocurre cuando el complemento solicita al usuario que guarde estas credenciales en Okta Personal. Se implementó una solución para escapar correctamente de estos campos, solucionando la vulnerabilidad. Es importante destacar que si Okta Personal no se agrega al complemento para habilitar la vista de múltiples cuentas, el complemento Workforce Identity Cloud no se ve afectado por este problema. La vulnerabilidad se solucionó en Okta Browser Plugin versión 6.32.0 para Chrome/Edge/Safari/Firefox."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Browser Plugin","defaultStatus":"unaffected","versions":[{"version":"6.5.0 through 6.31.0","versionType":"semver","status":"affected"},{"version":"6.32.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-24T13:21:12.411913Z","id":"CVE-2024-0981","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2024-7061","sourceIdentifier":"psirt@okta.com","published":"2024-08-07T17:15:52.113","lastModified":"2026-06-17T08:19:17.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."},{"lang":"es","value":"Okta Verify para Windows es vulnerable a la escalada de privilegios mediante el secuestro de DLL. La vulnerabilidad se solucionó en Okta Verify para Windows versión 5.0.2. Para corregir esta vulnerabilidad, actualice a 5.0.2 o superior."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Verify for Windows","defaultStatus":"unaffected","versions":[{"version":"5.0.1","lessThan":"5.0.1","versionType":"semver","status":"affected"},{"version":"5.0.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-08-09T13:44:41.455152Z","id":"CVE-2024-7061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-427"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:verify:*:*:*:*:*:windows:*:*","versionEndExcluding":"5.0.2","matchCriteriaId":"951E2564-0B8A-49B9-A130-4647DF323B7E"}]}]}],"references":[{"url":"https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4","source":"psirt@okta.com","tags":["Not Applicable","Release Notes"]},{"url":"https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-10327","sourceIdentifier":"psirt@okta.com","published":"2024-10-24T21:15:11.730","lastModified":"2026-06-17T06:55:25.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. \nThe ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: \n* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; \n* When a user is presented with a notification on the home screen and drags the notification down and selects their reply; \n* When an Apple Watch is used to reply directly to a notification. \n\n A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine."},{"lang":"es","value":"Una vulnerabilidad en Okta Verify para las versiones iOS 9.25.1 (beta) y 9.27.0 (incluida la beta) permite respuestas de notificaciones push a través de la función ContextExtension de iOS, lo que permite que la autenticación continúe independientemente de la selección del usuario. Cuando un usuario presiona prolongadamente el banner de notificación y selecciona una opción, ambas opciones permiten que la autenticación se realice correctamente. La función ContextExtension es uno de los varios mecanismos push disponibles al usar Okta Verify Push en dispositivos iOS. Los flujos vulnerables incluyen: * Cuando a un usuario se le presenta una notificación en una pantalla bloqueada, el usuario presiona la notificación directamente y selecciona su respuesta sin desbloquear el dispositivo; * Cuando a un usuario se le presenta una notificación en la pantalla de inicio y arrastra la notificación hacia abajo y selecciona su respuesta; * Cuando se usa un Apple Watch para responder directamente a una notificación. Una condición previa para esta vulnerabilidad es que el usuario debe haberse registrado en Okta Verify mientras el cliente de Okta usaba Okta Classic. Esto se aplica independientemente de si la organización se ha actualizado desde entonces a Okta Identity Engine."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Verify for iOS","defaultStatus":"unaffected","versions":[{"version":"9.25.1","versionType":"semver","status":"affected"},{"version":"9.27.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"okta","product":"verify","defaultStatus":"unknown","cpes":["cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"],"versions":[{"version":"9.25.1","status":"affected"},{"version":"9.27.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-25T15:21:49.116020Z","id":"CVE-2024-10327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://help.okta.com/en-us/content/topics/releasenotes/okta-verify-release-notes.htm#panel2","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2024-9191","sourceIdentifier":"psirt@okta.com","published":"2024-11-01T22:15:03.213","lastModified":"2026-06-17T08:24:06.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.\n\nNote: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected."},{"lang":"es","value":"Las funciones de Okta Device Access, proporcionadas por el agente Okta Verify para Windows, brindan acceso a OktaDeviceAccessPipe, que permite a los atacantes en un dispositivo comprometido recuperar las contraseñas asociadas con los inicios de sesión sin contraseña de Desktop MFA. La vulnerabilidad se descubrió mediante pruebas de penetración rutinarias. Nota: una condición previa de esta vulnerabilidad es que el usuario debe estar usando la función sin contraseña de Okta Device Access. Los usuarios de Okta Device Access que no usan la función sin contraseña no se ven afectados, y los clientes que solo usan Okta Verify en plataformas distintas de Windows o que solo usan FastPass no se ven afectados."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Verify for Windows","defaultStatus":"unaffected","versions":[{"version":"5.0.2","lessThan":"5.3.3","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"okta","product":"verify","defaultStatus":"unknown","cpes":["cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"],"versions":[{"version":"5.0.2","lessThan":"5.3.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-05T15:22:10.829745Z","id":"CVE-2024-9191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-276"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:verify:*:*:*:*:*:windows:*:*","versionStartIncluding":"5.0.2","versionEndExcluding":"5.3.3","matchCriteriaId":"F74F5903-4967-4F07-A68B-6BF6B56F089D"}]}]}],"references":[{"url":"https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4","source":"psirt@okta.com","tags":["Release Notes"]},{"url":"https://trust.okta.com/security-advisories/","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-9875","sourceIdentifier":"psirt@okta.com","published":"2024-11-21T09:54:49.903","lastModified":"2026-06-17T08:25:25.387","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."},{"lang":"es","value":"Las versiones 1.82.0 a 1.84.0 de Okta Privileged Access server agent (SFTD) se ven afectadas por una vulnerabilidad de escalada de privilegios cuando la función de paquetes de comandos sudo está habilitada. Para solucionar esta vulnerabilidad, actualice el agente de servidor de acceso privilegiado de Okta (SFTD) a la versión 1.87.1 o posterior."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Privileged Access Server Agent (SFTD)","defaultStatus":"unaffected","versions":[{"version":"1.82.0","lessThan":"1.84.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"okta","product":"privileged_access_server_agent_sftd","defaultStatus":"unaffected","cpes":["cpe:2.3:a:okta:privileged_access_server_agent_sftd:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.82.0","lessThan":"1.84.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-22T15:23:16.211195Z","id":"CVE-2024-9875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2025-7371","sourceIdentifier":"psirt@okta.com","published":"2025-07-22T16:15:34.890","lastModified":"2026-06-17T10:04:48.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions."},{"lang":"es","value":"Los agentes de Okta On-Premises Provisioning (OPP) registran ciertos datos de usuario durante los restablecimientos de contraseña iniciados por el administrador. Esta vulnerabilidad permite a un atacante con acceso a los servidores locales que ejecutan agentes OPP recuperar información personal del usuario y contraseñas temporales creadas durante el restablecimiento de contraseña. Esta vulnerabilidad afecta a los usuarios si se cumplen las siguientes condiciones: el servidor local ejecuta el agente OPP con versiones anteriores a la 2.2.1 y anteriores a la 2.3.0, y la cuenta de usuario ha sido restablecida por el administrador mientras utilizaba las versiones afectadas."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta On-Premises Provisioning Agent","defaultStatus":"unaffected","versions":[{"version":"2.2.1","lessThan":"2.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-22T19:20:52.253359Z","id":"CVE-2025-7371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://help.okta.com/oie/en-us/content/topics/settings/version_histories/ver_history_opp_agent.htm","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-77585","sourceIdentifier":"psirt@okta.com","published":"2026-08-25T20:17:06.477","lastModified":"2026-08-28T19:46:29.323","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Privileged Access Client","defaultStatus":"unaffected","versions":[{"version":"1.59.0","lessThan":"1.111.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-26T19:35:41.539004Z","id":"CVE-2026-77585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cve-2026-77585","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-78545","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:35.727","lastModified":"2026-09-29T20:19:22.983","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T18:00:45.406892Z","id":"CVE-2026-78545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78550","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:35.937","lastModified":"2026-09-29T20:13:02.940","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T17:52:34.962895Z","id":"CVE-2026-78550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-95"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-handling-in-okta-access-gateway-management-console-exception-handler-cve-2026-78550","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78552","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:36.073","lastModified":"2026-09-23T17:51:07.810","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T17:49:35.554063Z","id":"CVE-2026-78552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/validation-bypass-in-okta-access-gateway-custom-directives-cve-2026-78552","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78560","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:36.220","lastModified":"2026-09-23T18:00:37.843","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:30:48.218255Z","id":"CVE-2026-78560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-authentication-validation-in-okta-access-gateway-pass-through-authentication-source-cve-2026-78560","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78574","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:36.417","lastModified":"2026-09-23T18:12:49.403","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Hyperdrive Integration Plugin","defaultStatus":"unaffected","versions":[{"version":"1.2.0","lessThan":"1.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:36:30.614100Z","id":"CVE-2026-78574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-426"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.0","versionEndIncluding":"1.5.1","matchCriteriaId":"550E7082-8CD1-4755-9E90-D4422D0A8364"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-assembly-resolution-in-okta-hyperdrive-integration-plugin-registry-handling-cve-2026-78574","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78579","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:36.590","lastModified":"2026-09-23T18:17:08.527","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:37:45.517123Z","id":"CVE-2026-78579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-90"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-ldap-datastore-filter-interpolation-cve-2026-78579","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78620","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:36.777","lastModified":"2026-09-22T20:39:20.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:47:51.803109Z","id":"CVE-2026-78620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78623","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:37.050","lastModified":"2026-09-22T20:27:41.180","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T17:52:02.307541Z","id":"CVE-2026-78623","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78624","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:37.397","lastModified":"2026-09-22T20:19:15.390","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:31:34.907896Z","id":"CVE-2026-78624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78625","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:37.647","lastModified":"2026-09-22T20:16:41.267","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:34:46.618350Z","id":"CVE-2026-78625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78626","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:38.070","lastModified":"2026-09-22T20:14:53.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:35:14.242507Z","id":"CVE-2026-78626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-protected-rules-cve-2026-78626","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78627","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T20:18:38.440","lastModified":"2026-09-22T20:10:34.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Hyperdrive Integration Plugin","defaultStatus":"unaffected","versions":[{"version":"1.2.0","lessThan":"1.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.0,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:37:05.638378Z","id":"CVE-2026-78627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.0","versionEndExcluding":"1.5.2","matchCriteriaId":"9DD4DBB2-A0D6-4D8F-B9E8-B6A0F0B48178"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78622","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:41.233","lastModified":"2026-09-10T15:17:41.753","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Verify for Windows","defaultStatus":"unaffected","versions":[{"version":"5.1.3","lessThan":"7.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:41:50.671834Z","id":"CVE-2026-78622","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-link-resolution-in-okta-verify-for-windows-uninstaller-data-removal-cve-2026-78622","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-78629","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:41.347","lastModified":"2026-09-22T20:06:42.593","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Hyperdrive Agent","defaultStatus":"unaffected","versions":[{"version":"1.2.0","lessThan":"1.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:38:49.813878Z","id":"CVE-2026-78629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-303"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.0","versionEndExcluding":"1.5.2","matchCriteriaId":"9DD4DBB2-A0D6-4D8F-B9E8-B6A0F0B48178"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-authentication-verification-in-the-okta-hyperdrive-agent-mfa-response-handling-cve-2026-78629","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78630","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:41.457","lastModified":"2026-09-22T20:02:52.180","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:40:05.266289Z","id":"CVE-2026-78630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.9.1","matchCriteriaId":"C169A22F-2C3D-40B8-B3E7-1EEEAE47D950"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-neutralization-in-okta-access-gateway-snmp-configuration-processing-cve-2026-78630","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78631","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:41.570","lastModified":"2026-09-22T20:02:04.043","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Hyperdrive Agent","defaultStatus":"unaffected","versions":[{"version":"1.4.0","lessThan":"1.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:41:08.955407Z","id":"CVE-2026-78631","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:*","versionStartIncluding":"1.4.0","versionEndExcluding":"1.5.2","matchCriteriaId":"3807E9B6-008E-498B-AF97-7B8BD152ACCB"}]}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-restriction-of-sensitive-information-in-okta-hyperdrive-agent-logging-cve-2026-78631","source":"psirt@okta.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-78635","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:41.680","lastModified":"2026-09-10T15:17:42.800","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Privileged Access Client","defaultStatus":"unaffected","versions":[{"version":"1.18.0","lessThan":"1.113.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:38:13.258491Z","id":"CVE-2026-78635","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-84685","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:46.973","lastModified":"2026-09-10T15:17:48.687","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"react-native-auth0","defaultStatus":"unaffected","versions":[{"version":"5.0.0","lessThan":"5.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:44:19.402176Z","id":"CVE-2026-84685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-488"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-85981","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:47.173","lastModified":"2026-09-10T15:17:49.807","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 AD/LDAP Connector","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:42:14.078158Z","id":"CVE-2026-85981","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-85982","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:47.293","lastModified":"2026-09-10T15:17:49.920","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 AD/LDAP Connector","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:43:01.622324Z","id":"CVE-2026-85982","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/stored-cross-site-scripting-xss-in-auth0-ad-ldap-connector-cve-2026-85982","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-85983","sourceIdentifier":"psirt@okta.com","published":"2026-09-08T21:18:47.407","lastModified":"2026-09-10T15:17:50.033","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 AD/LDAP Connector","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T14:43:45.813987Z","id":"CVE-2026-85983","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-107369","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:17:32.093","lastModified":"2026-10-15T20:38:04.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"nextjs-auth0","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.32.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T18:41:22.614149Z","id":"CVE-2026-107369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-107370","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:17:32.207","lastModified":"2026-10-15T20:38:04.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"auth0-lock","defaultStatus":"unaffected","versions":[{"version":"10.9.0","lessThan":"13.2.1","versionType":"semver","status":"affected"},{"version":"14.0.0","lessThan":"15.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T18:40:51.235220Z","id":"CVE-2026-107370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"},{"lang":"en","value":"CWE-598"}]}],"references":[{"url":"https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-107371","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:17:32.317","lastModified":"2026-10-15T20:38:04.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"auth0.js","defaultStatus":"unaffected","versions":[{"version":"9.12.0","lessThan":"10.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T18:40:16.045683Z","id":"CVE-2026-107371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-78628","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:18:21.630","lastModified":"2026-10-15T20:38:04.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Credential Provider for Windows","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.4.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T19:27:16.578491Z","id":"CVE-2026-78628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-credential-provider-for-windows-cve-2026-78628","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-78632","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:18:21.747","lastModified":"2026-10-15T20:38:04.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta RADIUS Agent","defaultStatus":"unaffected","versions":[{"version":"2.17.5","lessThan":"2.28.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T18:39:40.534010Z","id":"CVE-2026-78632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-78633","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:18:21.853","lastModified":"2026-10-16T16:21:03.670","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta RADIUS Agent","defaultStatus":"unaffected","versions":[{"version":"2.17.5","lessThan":"2.28.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T15:26:09.166312Z","id":"CVE-2026-78633","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-85473","sourceIdentifier":"psirt@okta.com","published":"2026-10-13T21:19:19.020","lastModified":"2026-10-16T16:22:00.430","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"java-jwt","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T15:26:02.693134Z","id":"CVE-2026-85473","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-755"}]}],"references":[{"url":"https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm","source":"psirt@okta.com"},{"url":"https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-115546","sourceIdentifier":"psirt@okta.com","published":"2026-10-23T04:18:15.047","lastModified":"2026-10-23T16:44:17.950","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.10.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-23T10:46:17.787932Z","id":"CVE-2026-115546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"http://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-115547","sourceIdentifier":"psirt@okta.com","published":"2026-10-23T04:18:16.030","lastModified":"2026-10-23T16:44:17.950","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Okta","product":"Okta Access Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.10.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@okta.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-23T10:46:08.519933Z","id":"CVE-2026-115547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"http://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-107372","sourceIdentifier":"psirt@okta.com","published":"2026-11-10T21:17:52.713","lastModified":"2026-11-10T22:17:44.923","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 AI JS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-js-document-retrieval-cve-2026-107372","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-108167","sourceIdentifier":"psirt@okta.com","published":"2026-11-10T21:17:53.883","lastModified":"2026-11-10T22:17:44.923","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"auth0-ai-langchain","defaultStatus":"unaffected","collectionURL":"https://pypi.org","packageName":"auth0-ai-langchain","versions":[{"version":"0","lessThan":"1.0.2","versionType":"python","status":"affected"}]},{"vendor":"Auth0","product":"auth0-ai-llamaindex","defaultStatus":"unaffected","collectionURL":"https://pypi.org","packageName":"auth0-ai-llamaindex","versions":[{"version":"0","lessThan":"1.0.3","versionType":"python","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-126128","sourceIdentifier":"psirt@okta.com","published":"2026-11-10T21:19:27.440","lastModified":"2026-11-10T22:17:44.923","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 Node JS","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"7.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-706"}]}],"references":[{"url":"http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128","source":"psirt@okta.com"}]}},{"cve":{"id":"CVE-2026-126129","sourceIdentifier":"psirt@okta.com","published":"2026-11-10T22:18:31.733","lastModified":"2026-11-12T22:09:39.233","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 ASP.NET Core Authentication","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-807"},{"lang":"en","value":"CWE-1254"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129","source":"psirt@okta.com"}]}}]}