# Okta Verify for Windows local privilege escalation

Source: https://startwithidentity.com/cves/cve-2024-7061/
Last updated: 2026-08-13
License: content by Start with Identity. Cite the source URL.

---

## What broke

[Okta](https://startwithidentity.com/vendors/iam/okta/) Verify for Windows had a local privilege-escalation. A logged-on user could become a more privileged process. Okta patched the Verify client. This is the 2024 CVE that sits next to two Okta identity incidents that never received CVE IDs: the Classic application sign-on policy bypass for unknown user-agents (October 2024), and the AD/LDAP Delegated Authentication cache that used bcrypt on `userId + username + password`, so usernames longer than 52 characters could authenticate against the wrong cache key (30 October 2024).

## Why it matters

The MFA client is on every workstation. A local EoP there is how a standard user becomes the process that answers FastPass. Persistent Security also showed in 2024 that Okta Verify's Custom-URL fallback failed to check Origin, which undercut the "phishing-resistant" claim for FastPass. Three different Okta identity failures in one year, only one of them numbered.

## What to do

- Update Okta Verify for Windows to the patched build. Confirm via your MDM, not via "users will update."
- If you used AD/LDAP DelAuth in October 2024, read the 52-character advisory even though it has no CVE. Long usernames plus cache is an auth bypass.
- Review Classic sign-on policies for "unknown user-agent" holes. Scripts and uncommon browsers were the bypass.
- Treat FastPass as phishing-resistant only on the Loopback path. The Custom-URL fallback is a different control.

## Sources

- [NVD: CVE-2024-7061](https://nvd.nist.gov/vuln/detail/CVE-2024-7061)
- Okta Trust, AD/LDAP Delegated Authentication username advisory, 1 November 2024
- Okta Trust, Classic application sign-on policy bypass, October 2024