CVE-2024-7061Okta Verify for Windows local privilege escalation
What broke
Okta Verify for Windows had a local privilege-escalation. A logged-on user could become a more privileged process. Okta patched the Verify client. This is the 2024 CVE that sits next to two Okta identity incidents that never received CVE IDs: the Classic application sign-on policy bypass for unknown user-agents (October 2024), and the AD/LDAP Delegated Authentication cache that used bcrypt on userId + username + password, so usernames longer than 52 characters could authenticate against the wrong cache key (30 October 2024).
Why it matters
The MFA client is on every workstation. A local EoP there is how a standard user becomes the process that answers FastPass. Persistent Security also showed in 2024 that Okta Verify's Custom-URL fallback failed to check Origin, which undercut the "phishing-resistant" claim for FastPass. Three different Okta identity failures in one year, only one of them numbered.
What to do
- Update Okta Verify for Windows to the patched build. Confirm via your MDM, not via "users will update."
- If you used AD/LDAP DelAuth in October 2024, read the 52-character advisory even though it has no CVE. Long usernames plus cache is an auth bypass.
- Review Classic sign-on policies for "unknown user-agent" holes. Scripts and uncommon browsers were the bypass.
- Treat FastPass as phishing-resistant only on the Loopback path. The Custom-URL fallback is a different control.
Sources
- NVD: CVE-2024-7061
- Okta Trust, AD/LDAP Delegated Authentication username advisory, 1 November 2024
- Okta Trust, Classic application sign-on policy bypass, October 2024
Related identity CVEs
Related on Start with Identity
- CVEOkta Java SDK race condition crosses responses between requests
The Okta Java SDK could attach another request's response to yours (CWE-362). CVSS 8.4. Patched in v20.0.1, December 2025. Token mix-up in the official SDK.
- CVEZimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryHOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant met
- CVEVault root privilege escalation via policy-name normalization
Vault normalized policy names in a way that let a lower-privilege token become root. CVSS 7.2. Part of the August 2025 VaultFault set.