<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Okta Trust]]></title><description><![CDATA[Okta Trust]]></description><link>https://trust.okta.com</link><generator>GatsbyJS</generator><lastBuildDate>Tue, 10 Nov 2026 21:48:05 GMT</lastBuildDate><item><title><![CDATA[Improper Access Control in auth0-ai-python Document Retrieval CVE-2026-108167 - Nov 10, 2026]]></title><description><![CDATA[The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. To remediate, upgrade auth0-ai-langchain to version 1.0.2 or greater and auth0-ai-llamaindex to version 1.0.3 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167</guid><pubDate>Tue, 10 Nov 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Backchannel Session Revocation in the Auth0 ASP.NET Core Authentication SDK CVE-2026-126129 - Nov 10, 2026]]></title><description><![CDATA[The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints. To remediate, upgrade the Auth0 ASP.NET Core Authentication SDK to version 1.12.0. or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129</guid><pubDate>Tue, 10 Nov 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Validation of Path Parameters Auth0 Node.js SDK CVE-2026-126128 - Nov 10, 2026]]></title><description><![CDATA[The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit. To remediate, upgrade auth0/node-auth0 to version 7.7.1 or greater]]></description><link>https://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128</guid><pubDate>Tue, 10 Nov 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Access Control in auth0-ai-js Document Retrieval CVE-2026-107372 - Nov 10, 2026]]></title><description><![CDATA[The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. To remediate, upgrade @auth0/ai to version 6.0.3 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-js-document-retrieval-cve-2026-107372</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-js-document-retrieval-cve-2026-107372</guid><pubDate>Tue, 10 Nov 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026]]></title><description><![CDATA[Two critical remote code execution vulnerabilities, collectively referred to as PHP2Shell, were disclosed in PHP on October 21, 2026. The Okta Access Gateway includes a PHP runtime component affected by these vulnerabilities. To remediate, upgrade your Okta Access Gateway appliance version to 2026.44.0]]></description><link>https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619</guid><pubDate>Thu, 22 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547 - Oct 22, 2026]]></title><description><![CDATA[An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values.  To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547</guid><pubDate>Thu, 22 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546 - Oct 22, 2026]]></title><description><![CDATA[Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546</guid><pubDate>Thu, 22 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Validation in the Okta Credential Provider for Windows CVE-2026-78628 - Oct 13, 2026]]></title><description><![CDATA[The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. To remediate, upgrade the Okta Credential Provider for Windows to version 1.4.6.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-credential-provider-for-windows-cve-2026-78628</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-credential-provider-for-windows-cve-2026-78628</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Missing Verification of auth_time Claim in auth0.js CVE-2026-107371 - Oct 13, 2026]]></title><description><![CDATA[When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. To remediate this vulnerability, upgrade auth.js to version 10.3.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Request Handling for Active Directory Logins in auth0-lock CVE-2026-107370 - Oct 13, 2026]]></title><description><![CDATA[When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. To remediate this vulnerability, upgrade auth0-lock to version 13.2.1, or version 15.0.2 and greater. ]]></description><link>https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Insecure Default File Permissions in Okta RADIUS Agent Windows Installer CVE-2026-78632 - Oct 13, 2026]]></title><description><![CDATA[The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs.  To remediate this vulnerability, upgrade the Okta RADIUS Agent to version 2.28.0 or greater. ]]></description><link>https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Denial of Service in Okta RADIUS Agent Packet Parser CVE-2026-78633 - Oct 13, 2026]]></title><description><![CDATA[The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. To remediate this vulnerability, upgrade the Okta RADIUS Agent to version 2.28.0 or greater. ]]></description><link>https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Out-of-Range Timestamp Claim Handling in auth0/java-jwt CVE-2026-85473 - Oct 13, 2026]]></title><description><![CDATA[The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. To remediate, upgrade auth0/java-jwt to version 4.6.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Validation of Post-Login Redirect URL in nextjs-auth0 CVE-2026-107369 - Oct 13, 2026]]></title><description><![CDATA[The auth0/nextjs-auth0 SDK returnTo reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain. To remediate, upgrade auth0/nextjs-auth0 to version 4.32.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369</guid><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal CVE-2026-78622 - Sep 8, 2026]]></title><description><![CDATA[The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. To remediate this vulnerability, upgrade the Okta Verify for Windows client to version 7.0.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-link-resolution-in-okta-verify-for-windows-uninstaller-data-removal-cve-2026-78622</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-link-resolution-in-okta-verify-for-windows-uninstaller-data-removal-cve-2026-78622</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Local Privilege Escalation in Auth0 AD/LDAP Connector CVE-2026-85983 - Sep 8, 2026]]></title><description><![CDATA[The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. To remediate, upgrade the auth0/ad-ldap-connector to version 7.00 or greater.]]></description><link>https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector CVE-2026-85982 - Sep 8, 2026]]></title><description><![CDATA[The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. To remediate, upgrade the auth0/ad-ldap-connector to version 7.0.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/stored-cross-site-scripting-xss-in-auth0-ad-ldap-connector-cve-2026-85982</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/stored-cross-site-scripting-xss-in-auth0-ad-ldap-connector-cve-2026-85982</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector CVE-2026-85981 - Sep 8, 2026]]></title><description><![CDATA[The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. To remediate, upgrade the auth0/ad-ldap-connector version 6.6.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management CVE-2026-84685 - Sep 8, 2026]]></title><description><![CDATA[The react-native-auth0 SDK’s web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Customers running react-native-auth0 version 5.0.0 through 5.11.0 are affected.]]></description><link>https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling CVE-2026-78574 - Sep 8, 2026]]></title><description><![CDATA[The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. To remediate this vulnerability, upgrade the Okta Hyperdrive Integration plugin to version 1.5.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-assembly-resolution-in-okta-hyperdrive-integration-plugin-registry-handling-cve-2026-78574</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-assembly-resolution-in-okta-hyperdrive-integration-plugin-registry-handling-cve-2026-78574</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Sanitization in Okta Access Gateway Protected Rules CVE-2026-78626 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources. To remediate this vulnerability, upgrade Okta Access Gateway to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-protected-rules-cve-2026-78626</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-protected-rules-cve-2026-78626</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Credential Protection in Okta Hyperdrive Integration Installer Logging CVE-2026-78627 - Sep 8, 2026]]></title><description><![CDATA[The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. To remediate this vulnerability, upgrade the Okta Hyperdrive Integration plugin to version 1.5.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation CVE-2026-78579 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-ldap-datastore-filter-interpolation-cve-2026-78579</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-ldap-datastore-filter-interpolation-cve-2026-78579</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling CVE-2026-78620 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument CVE-2026-78635 - Sep 8, 2026]]></title><description><![CDATA[The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. To remediate this vulnerability, upgrade the Okta Privileged Access client to version 1.113.0.]]></description><link>https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling CVE-2026-78629 - Sep 8, 2026]]></title><description><![CDATA[The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization’s policy requires no MFA for a given user.  To remediate this vulnerability, upgrade the Okta Hyperdrive agent to version 1.5.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-authentication-verification-in-the-okta-hyperdrive-agent-mfa-response-handling-cve-2026-78629</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-authentication-verification-in-the-okta-hyperdrive-agent-mfa-response-handling-cve-2026-78629</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing CVE-2026-78630 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-input-neutralization-in-okta-access-gateway-snmp-configuration-processing-cve-2026-78630</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-neutralization-in-okta-access-gateway-snmp-configuration-processing-cve-2026-78630</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging CVE-2026-78631 - Sep 8, 2026]]></title><description><![CDATA[The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion.  To remediate this vulnerability, upgrade the Okta Hyperdrive Agent to version 1.5.2 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-restriction-of-sensitive-information-in-okta-hyperdrive-agent-logging-cve-2026-78631</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-restriction-of-sensitive-information-in-okta-hyperdrive-agent-logging-cve-2026-78631</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Sanitization in Okta Access Gateway Application Label Configuration CVE-2026-78545 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Input Handling in Okta Access Gateway Management Console Exception Handler CVE-2026-78550 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-input-handling-in-okta-access-gateway-management-console-exception-handler-cve-2026-78550</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-input-handling-in-okta-access-gateway-management-console-exception-handler-cve-2026-78550</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores CVE-2026-78623 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Validation Bypass in Okta Access Gateway Custom Directives CVE-2026-78552 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/validation-bypass-in-okta-access-gateway-custom-directives-cve-2026-78552</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/validation-bypass-in-okta-access-gateway-custom-directives-cve-2026-78552</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source CVE-2026-78560 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-authentication-validation-in-okta-access-gateway-pass-through-authentication-source-cve-2026-78560</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-authentication-validation-in-okta-access-gateway-pass-through-authentication-source-cve-2026-78560</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Path Validation in Okta Access Gateway Backup and Restore Functionality CVE-2026-78624 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater. ]]></description><link>https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration CVE-2026-78625 - Sep 8, 2026]]></title><description><![CDATA[The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. To remediate this vulnerability, upgrade Okta Access Gateway to version 2026.9.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Validation of SSH Target in Okta Privileged Access Client CVE-2026-77585 - Aug 25, 2026]]></title><description><![CDATA[The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. To remediate, upgrade the Okta Privileged Access client to version 1.111.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cve-2026-77585</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cve-2026-77585</guid><pubDate>Tue, 25 Aug 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CVE-2026-50157 - Jun 10, 2026]]></title><description><![CDATA[Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints. To remediate, upgrade auth0/symfony to version 5.9.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/bearer-token-accepted-via-url-query-parameter-auth0-symfony-sdk-cve-2026-50157</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/bearer-token-accepted-via-url-query-parameter-auth0-symfony-sdk-cve-2026-50157</guid><pubDate>Wed, 10 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Permission Checking in Auth0.js SDK CVE-2026-42280 - May 6, 2026]]></title><description><![CDATA[Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Upgrade auth0/auth0.js to version 10.0.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-permission-checking-auth0-js-sdk-cve-2026-42280</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-permission-checking-auth0-js-sdk-cve-2026-42280</guid><pubDate>Wed, 06 May 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Proxy Cache Lookup in the Auth0 Next.js SDK CVE-2026-40155 - Apr 17, 2026]]></title><description><![CDATA[In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. To remediate, upgrade Auth0/nextjs-auth0 version to version 4.18.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-proxy-cache-lookup-auth0-next-js-sdk-cve-2026-40155</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-proxy-cache-lookup-auth0-next-js-sdk-cve-2026-40155</guid><pubDate>Fri, 17 Apr 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDK CVE-2026-34236 - Apr 1, 2026]]></title><description><![CDATA[In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. To remediate, upgrade Auth0/symfony-auth0 to version 5.8.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/insufficient-entropy-cookie-encryption-auth0-symfony-sdk-cve-2026-34236</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/insufficient-entropy-cookie-encryption-auth0-symfony-sdk-cve-2026-34236</guid><pubDate>Wed, 01 Apr 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Insufficient Entropy in Cookie Encryption in Auth0 WordPress Plugin CVE-2026-34236 - Apr 1, 2026]]></title><description><![CDATA[In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. To remediate, upgrade Auth0/wordpress to version 5.6.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/insufficient-entropy-cookie-encryption-auth0-wordpress-plugin-cve-2026-34236</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/insufficient-entropy-cookie-encryption-auth0-wordpress-plugin-cve-2026-34236</guid><pubDate>Wed, 01 Apr 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Insufficient Entropy in Cookie Encryption in Auth0 laravel-auth0 SDK CVE-2026-34236 - Apr 1, 2026]]></title><description><![CDATA[In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. To remediate, upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/insufficient-entropy-cookie-encryption-auth0-laravel-auth0-sdk-cve-2026-34236</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/insufficient-entropy-cookie-encryption-auth0-laravel-auth0-sdk-cve-2026-34236</guid><pubDate>Wed, 01 Apr 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Auth0 PHP SDK Insufficient Entropy in Cookie Encryption CVE-2026-34236 - Apr 1, 2026]]></title><description><![CDATA[In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. To remediate, upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/auth0-php-sdk-insufficient-entropy-cookie-encryption-cve-2026-34236</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/auth0-php-sdk-insufficient-entropy-cookie-encryption-cve-2026-34236</guid><pubDate>Wed, 01 Apr 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Validation of Query Parameters in Auth0 Next.js SDK CVE-2025-67716 - Dec 10, 2025]]></title><description><![CDATA[An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. To remediate, upgrade Auth0/nextjs-auth0 version to v4.13.0]]></description><link>https://trust.okta.com/security-advisories/improper-validation-of-query-parameters-auth0-next-js-sdk-cve-2025-67716</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-validation-of-query-parameters-auth0-next-js-sdk-cve-2025-67716</guid><pubDate>Wed, 10 Dec 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490 - Dec 10, 2025]]></title><description><![CDATA[When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. To remediate, Upgrade Auth0/nextjs-auth0 version to 4.11.2 or 4.12.1.]]></description><link>https://trust.okta.com/security-advisories/improper-request-caching-lookup-auth0-next-js-sdk-cve-2025-67490</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-request-caching-lookup-auth0-next-js-sdk-cve-2025-67490</guid><pubDate>Wed, 10 Dec 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper Memory Cleanup in the Okta Java SDK CVE-2025-66033 - Dec 10, 2025]]></title><description><![CDATA[In the Okta Java SDK, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. To remediate, Upgrade Okta/okta-sdk-java to versions 24.0.1 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-memory-cleanup-okta-java-sdk-cve-2025-66033</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-memory-cleanup-okta-java-sdk-cve-2025-66033</guid><pubDate>Wed, 10 Dec 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Race condition in the Okta Java SDK CVE-2025-67505 - Dec 10, 2025]]></title><description><![CDATA[In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. To remediate, upgrade Okta/okta-sdk-java to versions 21.0.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/race-condition-okta-java-sdk-cve-2025-67505</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/race-condition-okta-java-sdk-cve-2025-67505</guid><pubDate>Wed, 10 Dec 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper HMAC Signature Verification in auth0/node-jws CVE-2025-65945 - Dec 4, 2025]]></title><description><![CDATA[An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. To remediate, upgrade auth0/node-jws version to version 3.2.3 or 4.0.1.]]></description><link>https://trust.okta.com/security-advisories/improper-hmac-signature-verification-auth0-node-jws-cve-2025-65945</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-hmac-signature-verification-auth0-node-jws-cve-2025-65945</guid><pubDate>Thu, 04 Dec 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper File Type Handling in Bulk User Import in Auth0 Wordpress plugin CVE-2025-58769 - Oct 1, 2025]]></title><description><![CDATA[In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. To remediate, upgrade Auth0 Wordpress plugin to version 5.4.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-auth0-wordpress-plugin-cve-2025-58769</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-auth0-wordpress-plugin-cve-2025-58769</guid><pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper File Type Handling in Bulk User Import in Auth0 Symfony SDK CVE-2025-58769 - Oct 1, 2025]]></title><description><![CDATA[In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. To remediate, upgrade Auth0/symfony to version 5.5.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-auth0-symfony-sdk-cve-2025-58769</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-auth0-symfony-sdk-cve-2025-58769</guid><pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper File Type Handling in Bulk User Import in laravel-auth0 SDK CVE-2025-58769 - Oct 1, 2025]]></title><description><![CDATA[In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value.  To remediate, upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-laravel-auth0-sdk-cve-2025-58769</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-laravel-auth0-sdk-cve-2025-58769</guid><pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Improper File Type Handling in Bulk User Import in auth0-PHP SDK CVE-2025-58769 - Oct 1, 2025]]></title><description><![CDATA[In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. To remediate, upgrade Auth0/Auth0-PHP to version 8.17.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-auth0-php-sdk-cve-2025-58769</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/improper-file-type-handling-bulk-user-import-auth0-php-sdk-cve-2025-58769</guid><pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta On-Premises Provisioning (OPP) Password Reset Information Disclosure CVE-2025-7371 - Jul 22, 2025]]></title><description><![CDATA[The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. Upgrade the Auth0 WordPress plugin to version 5.3.0.]]></description><link>https://trust.okta.com/security-advisories/okta-on-premises-provisioning-opp-password-reset-information-disclosure-cve-2025-7371</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-on-premises-provisioning-opp-password-reset-information-disclosure-cve-2025-7371</guid><pubDate>Tue, 22 Jul 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[CDN Caching of Session Cookies in NextJS-Auth0 SDK CVE-2025-48947 - Jun 3, 2025]]></title><description><![CDATA[In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Upgrade auth0/nextjs-auth0 to version 4.6.1.]]></description><link>https://trust.okta.com/security-advisories/cdn-caching-of-session-cookies-nextjs-auth0-sdk-cve-2025-48947</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/cdn-caching-of-session-cookies-nextjs-auth0-sdk-cve-2025-48947</guid><pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Deserialization of Untrusted Data in Auth0-PHP SDK CVE-2025-48951 - Jun 3, 2025]]></title><description><![CDATA[The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. Upgrade Auth0/Auth0-PHP to version 8.14.0.]]></description><link>https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-auth0-php-sdk-cve-2025-48951</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-auth0-php-sdk-cve-2025-48951</guid><pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Deserialization of Untrusted Data in Auth0 Symfony SDK CVE-2025-48951 - Jun 3, 2025]]></title><description><![CDATA[The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. Upgrade Auth0/symfony to version 5.4.0.]]></description><link>https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-in-auth0-symfony-sdk-cve-2025-48951</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-in-auth0-symfony-sdk-cve-2025-48951</guid><pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Deserialization of Untrusted Data in laravel-auth0 SDK CVE-2025-48951 - Jun 3, 2025]]></title><description><![CDATA[The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. Upgrade Auth0/laravel-auth0 to version v7.17.0.]]></description><link>https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-laravel-auth0-sdk-cve-2025-48951</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-laravel-auth0-sdk-cve-2025-48951</guid><pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Deserialization of Untrusted Data in Auth0 Wordpress Plugin CVE-2025-48951 - Jun 3, 2025]]></title><description><![CDATA[The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. Upgrade the Auth0 WordPress plugin to version 5.3.0.]]></description><link>https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-auth0-wordpress-plugin-cve-2025-48951</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/deserialization-of-untrusted-data-auth0-wordpress-plugin-cve-2025-48951</guid><pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275 - May 15, 2025]]></title><description><![CDATA[Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Upgrade Auth0/Auth0-PHP to version 8.14.0.]]></description><link>https://trust.okta.com/security-advisories/brute-force-authentication-tags-of-cookiestore-sessions-in-auth0-php-sdk-cve-2025-47275</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/brute-force-authentication-tags-of-cookiestore-sessions-in-auth0-php-sdk-cve-2025-47275</guid><pubDate>Thu, 15 May 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Brute Force Authentication Tags of CookieStore Sessions in Auth0 Symfony SDK CVE-2025-47275 - May 15, 2025]]></title><description><![CDATA[Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Upgrade Auth0/Auth0-PHP to version 8.14.0. ]]></description><link>https://trust.okta.com/security-advisories/brute-force-authentication-tags-of-cookiestore-sessions-auth0-php-sdk-cve-2025-47275</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/brute-force-authentication-tags-of-cookiestore-sessions-auth0-php-sdk-cve-2025-47275</guid><pubDate>Thu, 15 May 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Brute Force Authentication Tags of CookieStore Sessions in Auth0 Wordpress plugin CVE-2025-47275 - May 15, 2025]]></title><description><![CDATA[Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Upgrade Auth0/wordpress plugin to version 5.3.0. ]]></description><link>https://trust.okta.com/security-advisories/brute-force-authentication-tags-cookiestore-sessions-auth0-wordpress-plugin-cve-2025-47275</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/brute-force-authentication-tags-cookiestore-sessions-auth0-wordpress-plugin-cve-2025-47275</guid><pubDate>Thu, 15 May 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Brute Force Authentication Tags of CookieStore Sessions in laravel-auth0 SDK CVE-2025-47275 - May 15, 2025]]></title><description><![CDATA[Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Upgrade Auth0/laravel-auth0 to version 7.17.0.]]></description><link>https://trust.okta.com/security-advisories/brute-force-authentication-tags-of-cookiestore-sessions-laravel-auth0-sdk-cve-2025-47275</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/brute-force-authentication-tags-of-cookiestore-sessions-laravel-auth0-sdk-cve-2025-47275</guid><pubDate>Thu, 15 May 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-Fed CVE-2025-46573 - May 6, 2025]]></title><description><![CDATA[This vulnerability allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response in Passport-WS-Fed. Upgrade to v4.6.4 or greater.]]></description><link>https://trust.okta.com/security-advisories/saml-attribute-smuggling-vulnerability-allowing-user-impersonation-passport-ws-fed-cve-2025-46573</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/saml-attribute-smuggling-vulnerability-allowing-user-impersonation-passport-ws-fed-cve-2025-46573</guid><pubDate>Tue, 06 May 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-Fed CVE-2025-46572 - May 6, 2025]]></title><description><![CDATA[This vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse in Passport-WS-Fed. Upgrade to v4.6.4 or greater.]]></description><link>https://trust.okta.com/security-advisories/saml-signature-wrapping-vulnerability-leading-to-user-impersonation-in-passport-ws-fed-cve-2025-46572</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/saml-signature-wrapping-vulnerability-leading-to-user-impersonation-in-passport-ws-fed-cve-2025-46572</guid><pubDate>Tue, 06 May 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[JWT Invalid Signature Validation in Auth0 Account Linking Extensions CVE-2025-46345 - Apr 30, 2025]]></title><description><![CDATA[Auth0 Account Linking Extensions versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. Upgrade to the latest version 3.0.0 or greater.]]></description><link>https://trust.okta.com/security-advisories/jwt-invalid-signature-validation-in-auth0-account-linking-extensions-cve-2025-46345</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/jwt-invalid-signature-validation-in-auth0-account-linking-extensions-cve-2025-46345</guid><pubDate>Wed, 30 Apr 2025 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Verify Desktop MFA for Windows Passwordless Login CVE-2024-9191 - Nov 1, 2024]]></title><description><![CDATA[A vulnerability was identified in Okta Verify for Windows, allowing retrieval of passwords associated with Desktop MFA passwordless logins in a compromised device.]]></description><link>https://trust.okta.com/security-advisories/okta-verify-desktop-mfa-for-windows-passwordless-login-cve-2024-9191</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-verify-desktop-mfa-for-windows-passwordless-login-cve-2024-9191</guid><pubDate>Fri, 01 Nov 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory - Nov 1, 2024]]></title><description><![CDATA[A vulnerability was internally identified in generating the cache key for AD/LDAP DelAuth.]]></description><link>https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username</guid><pubDate>Fri, 01 Nov 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Verify for iOS ContextExtension CVE-2024-10327 - Oct 24, 2024]]></title><description><![CDATA[A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature to bypass proper authentication validation. ]]></description><link>https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327</guid><pubDate>Thu, 24 Oct 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Classic Application Sign-On Policy Bypass - Oct 4, 2024]]></title><description><![CDATA[A vulnerability was identified in specific Okta configurations whereby ​​an attacker with valid credentials could bypass configured conditions within application-specific sign-on policies.]]></description><link>https://trust.okta.com/security-advisories/okta-classic-application-sign-on-policy-bypass-2024</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-classic-application-sign-on-policy-bypass-2024</guid><pubDate>Fri, 04 Oct 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Verify for Windows Privilege Escalation CVE-2024-7061 - Aug 7, 2024]]></title><description><![CDATA[Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking.]]></description><link>https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061</guid><pubDate>Wed, 07 Aug 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Browser Plugin Reflected Cross-Site Scripting CVE-2024-0981 - Jul 22, 2024]]></title><description><![CDATA[Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting.]]></description><link>https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981</guid><pubDate>Mon, 22 Jul 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Verify for Windows Auto-update Arbitrary Code Execution CVE-2024-0980 - Mar 26, 2024]]></title><description><![CDATA[The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.]]></description><link>https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980</guid><pubDate>Tue, 26 Mar 2024 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta LDAP Agent CVE-2023-0392 - Sep 19, 2023]]></title><description><![CDATA[The LDAP Agent Update service used an unquoted path, which could allow arbitrary code execution. ]]></description><link>https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392</guid><pubDate>Tue, 19 Sep 2023 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Advanced Server Access Client CVE-2023-0093 - Feb 22, 2023]]></title><description><![CDATA[Okta Advanced Server Access Client versions 1.13.1 through 1.68.1 are vulnerable to command injection due to the third-party library webbrowser.]]></description><link>https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093</guid><pubDate>Wed, 22 Feb 2023 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Access Gateway Advisory for CVE-2022-3602 and CVE-2022-3786 - Nov 1, 2022]]></title><description><![CDATA[On November 1, 2022 the OpenSSL organization disclosed two high-severity vulnerabilities in version 3.0 and above which are patched in OpenSSL 3.0.7.  Okta has investigated the usage of the vulnerabilities and will continue to assess the potential impact to our dependencies and third parties. Okta Access Gateway has been found to use the OpenSSL 3.0 codebase since the release of 2022.10.0.  Customers that have not yet updated to 2022.10.0 should refrain from updating to 2022.10.0 which contains OpenSSL 3.0 until an updated version is available. Okta Access Gateway customers who have updated to 2022.10.0 will be provided an updated version 2022.11.0 as soon as possible. Currently estimated to be available on 11/04/2022.]]></description><link>https://trust.okta.com/security-advisories/okta-access-gateway-advisory-cve-2022-3602-and-cve-2022-3786</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-access-gateway-advisory-cve-2022-3602-and-cve-2022-3786</guid><pubDate>Tue, 01 Nov 2022 19:47:00 GMT</pubDate></item><item><title><![CDATA[Okta Active Directory Agent CVE-2022-1697 - Sep 1, 2022]]></title><description><![CDATA[Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path.]]></description><link>https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697</guid><pubDate>Thu, 01 Sep 2022 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Advanced Server Access Client CVE-2022-1030 - Mar 21, 2022]]></title><description><![CDATA[Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute commands on the local system.]]></description><link>https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030</guid><pubDate>Mon, 21 Mar 2022 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Advanced Server Access Client CVE-2022-24295 - Feb 17, 2022]]></title><description><![CDATA[Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL.]]></description><link>https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295</guid><pubDate>Thu, 17 Feb 2022 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta RADIUS Server Agent CVE-2021-45105 - Jan 26, 2022]]></title><description><![CDATA[Apache Log4j2 2.16.0, as used in Okta RADIUS Server Agent 2.17.1 and lower, did not protect from uncontrolled recursion from self-referential lookups. While Okta found no evidence that this agent was impacted, due to the lack of preconditions that must exist for this vulnerability to be exploitable, we have released an updated version of the agent. The new version includes Log4j 2.17.0, which fixes this issue.]]></description><link>https://trust.okta.com/security-advisories/okta-radius-server-agent-cve-2021-45105</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-radius-server-agent-cve-2021-45105</guid><pubDate>Wed, 26 Jan 2022 22:53:00 GMT</pubDate></item><item><title><![CDATA[Okta On-Prem MFA Agent CVE-2021-45046 - Jan 26, 2022]]></title><description><![CDATA[Apache Log4j2 2.15.0, as used in Okta On-Prem MFA Agent 1.4.6 (formerly Okta RSA SecurID Agent), contained an incomplete fix for CVE-2021-44228, which could allow attackers under certain conditions to craft malicious input data, resulting in a denial of service (DOS) attack. The new version includes Log4j 2.16.0 which fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.]]></description><link>https://trust.okta.com/security-advisories/okta-prem-mfa-agent-cve-2021-45046</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-prem-mfa-agent-cve-2021-45046</guid><pubDate>Wed, 26 Jan 2022 22:52:00 GMT</pubDate></item><item><title><![CDATA[Okta RADIUS Server Agent CVE-2021-45046 - Jan 26, 2022]]></title><description><![CDATA[Apache Log4j2 2.15.0, as used in Okta RADIUS Server Agent 2.17.0, contained an incomplete fix for CVE-2021-44228, which could allow attackers under certain conditions to craft malicious input data, resulting in a denial of service (DOS) attack. The new version includes Log4j 2.16.0 which fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.]]></description><link>https://trust.okta.com/security-advisories/okta-radius-server-agent-cve-2021-45046</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-radius-server-agent-cve-2021-45046</guid><pubDate>Wed, 26 Jan 2022 22:51:00 GMT</pubDate></item><item><title><![CDATA[Okta On-Prem MFA Agent CVE-2021-44228 - Jan 26, 2022]]></title><description><![CDATA[Apache Log4j2 <=2.14.1, as used in Okta On-Prem MFA Agent (formerly Okta RSA SecurID Agent) prior to 1.4.6, does not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers. ]]></description><link>https://trust.okta.com/security-advisories/okta-prem-mfa-agent-cve-2021-44228</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-prem-mfa-agent-cve-2021-44228</guid><pubDate>Wed, 26 Jan 2022 22:50:00 GMT</pubDate></item><item><title><![CDATA[Okta RADIUS Server Agent CVE-2021-44228 - Jan 26, 2022]]></title><description><![CDATA[Apache Log4j2 <=2.14.1, as used in Okta RADIUS Server Agent prior to 2.17.0, does not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers. ]]></description><link>https://trust.okta.com/security-advisories/okta-radius-server-agent-cve-2021-44228</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-radius-server-agent-cve-2021-44228</guid><pubDate>Wed, 26 Jan 2022 22:48:00 GMT</pubDate></item><item><title><![CDATA[Okta On-Prem MFA Agent CVE-2021-45105 - Jan 26, 2022]]></title><description><![CDATA[Apache Log4j2 2.16.0, as used in Okta On-Prem MFA Agent 1.4.7 and lower (formerly Okta RSA SecurID Agent), did not protect from uncontrolled recursion from self-referential lookups. While Okta found no evidence that this agent was impacted, due to the lack of preconditions that must exist for this vulnerability to be exploitable, we have released an updated version of the agent. The new version includes Log4j 2.17.0, which fixes this issue.]]></description><link>https://trust.okta.com/security-advisories/okta-prem-mfa-agent-cve-2021-45105</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-prem-mfa-agent-cve-2021-45105</guid><pubDate>Wed, 26 Jan 2022 00:00:00 GMT</pubDate></item><item><title><![CDATA[Okta Access Gateway CVE-2021-28113 - Apr 2, 2021]]></title><description><![CDATA[A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway in version 2020.8.4 and earlier allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account. ]]></description><link>https://trust.okta.com/security-advisories/okta-access-gateway-cve-2021-28113</link><guid isPermaLink="false">https://trust.okta.com/security-advisories/okta-access-gateway-cve-2021-28113</guid><pubDate>Fri, 02 Apr 2021 00:00:00 GMT</pubDate></item></channel></rss>