彙總 okta 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與開放重定向 等問題，部分漏洞可能導致 檔案覆寫，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-67505 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1. | [email protected] | 8.4 | 0.18% | 2025-12-10 | 2026-06-17 |
| CVE-2025-66033 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a l | [email protected] | 5.3 | 0.23% | 2025-12-10 | 2026-06-17 |
| CVE-2024-9191 | The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing. Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and | [email protected] | 7.1 | 0.21% | 2024-11-01 | 2026-06-17 |
| CVE-2024-7061 | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater. | [email protected] | 5.5 | 0.21% | 2024-08-07 | 2026-06-17 |
| CVE-2023-0392 | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. | [email protected] | 6.7 | 0.20% | 2023-11-08 | 2026-06-17 |
| CVE-2021-45094 | Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS. | [email protected] | 5.4 | 0.47% | 2023-07-20 | 2026-06-17 |
| CVE-2023-0093 | Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment. | [email protected] | 8.8 | 1.10% | 2023-03-06 | 2026-06-17 |
| CVE-2022-3145 | An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. | [email protected] | 4.7 | 0.41% | 2023-01-12 | 2026-06-17 |
| CVE-2022-1697 | Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation. | [email protected] | 3.9 | 0.24% | 2022-09-06 | 2026-06-17 |
| CVE-2022-1030 | Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute commands on the local system. | [email protected] | 8.8 | 1.47% | 2022-03-23 | 2026-06-17 |
| CVE-2022-24295 | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. | [email protected] | 8.8 | 17.85% | 2022-02-21 | 2026-06-17 |
| CVE-2021-28113 | A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. | [email protected] | 6.7 | 22.33% | 2021-04-02 | 2026-06-16 |