GHSA-j5gq-897m-2rff (CVE-2025-67505)

Details

Description

In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response.

Affected product and versions

You may be affected if you meet the following preconditions:

Using the Okta Java SDK between versions 11.0.0 and 20.0.0, and
Implementing a multithreaded application with the ApiClient class where the response status code is used in access control flows

Resolution

Upgrade Okta/okta-sdk-java to versions 21.0.0 or greater.

Affected Packages

com.okta.sdk:okta-sdk-root

Maven

Fixed in:

20.0.1

References

ADVISORYhttps://github.com/advisories/GHSA-j5gq-897m-2rff PACKAGEhttps://github.com/okta/okta-sdk-java WEBhttps://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243 WEBhttps://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff

GHSA-j5gq-897m-2rff

Details

Description

Affected product and versions

Resolution

Affected Packages

References

Aliases

CVSS Analysis

Related

Ecosystems

Timeline