Start with Identity
Subscribe
Identity CVE · Other

CVE-2024-7061Okta Verify for Windows local privilege escalation

high
Product: Okta Verify for WindowsVendor: OktaDisclosed: 2024-07-23Status: PatchedNVD ↗

What broke

Okta Verify for Windows had a local privilege-escalation. A logged-on user could become a more privileged process. Okta patched the Verify client. This is the 2024 CVE that sits next to two Okta identity incidents that never received CVE IDs: the Classic application sign-on policy bypass for unknown user-agents (October 2024), and the AD/LDAP Delegated Authentication cache that used bcrypt on userId + username + password, so usernames longer than 52 characters could authenticate against the wrong cache key (30 October 2024).

Why it matters

The MFA client is on every workstation. A local EoP there is how a standard user becomes the process that answers FastPass. Persistent Security also showed in 2024 that Okta Verify's Custom-URL fallback failed to check Origin, which undercut the "phishing-resistant" claim for FastPass. Three different Okta identity failures in one year, only one of them numbered.

What to do

  • Update Okta Verify for Windows to the patched build. Confirm via your MDM, not via "users will update."
  • If you used AD/LDAP DelAuth in October 2024, read the 52-character advisory even though it has no CVE. Long usernames plus cache is an auth bypass.
  • Review Classic sign-on policies for "unknown user-agent" holes. Scripts and uncommon browsers were the bypass.
  • Treat FastPass as phishing-resistant only on the Loopback path. The Custom-URL fallback is a different control.

Sources

  • NVD: CVE-2024-7061
  • Okta Trust, AD/LDAP Delegated Authentication username advisory, 1 November 2024
  • Okta Trust, Classic application sign-on policy bypass, October 2024

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.