Start with Identity
Subscribe
Identity CVE · Other

CVE-2025-67505Okta Java SDK race condition crosses responses between requests

high · CVSS 8.4
Product: Okta Java SDKVendor: OktaCWE-362Disclosed: 2025-12-11Status: PatchedNVD ↗

What broke

The Okta Java SDK had a race (CWE-362) that could return client B's API response to client A. Under load, that response can include tokens, factors, or user profile data. CVSS 8.4. Patched in v20.0.1 (December 2025).

Why it matters

This is not an Okta-service auth bypass. It is worse in a different way: the official SDK, in your JVM, mixing identity responses. Same class as Duende's token-management race. Customers will file it as "intermittent wrong user" until someone reads the advisory.

What to do

  • Upgrade the Okta Java SDK to 20.0.1 or later in every service that talks to Okta.
  • Load-test after the upgrade: two users, concurrent calls, assert sub never crosses.
  • Review logs from December 2025 for support cases that look like session mix-up.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.