CVE-2024-7061Okta Verify for Windows local privilege escalation
What broke
Okta Verify for Windows had a local privilege-escalation. A logged-on user could become a more privileged process. Okta patched the Verify client. This is the 2024 CVE that sits next to two Okta identity incidents that never received CVE IDs: the Classic application sign-on policy bypass for unknown user-agents (October 2024), and the AD/LDAP Delegated Authentication cache that used bcrypt on userId + username + password, so usernames longer than 52 characters could authenticate against the wrong cache key (30 October 2024).
Why it matters
The MFA client is on every workstation. A local EoP there is how a standard user becomes the process that answers FastPass. Persistent Security also showed in 2024 that Okta Verify's Custom-URL fallback failed to check Origin, which undercut the "phishing-resistant" claim for FastPass. Three different Okta identity failures in one year, only one of them numbered.
What to do
- Update Okta Verify for Windows to the patched build. Confirm via your MDM, not via "users will update."
- If you used AD/LDAP DelAuth in October 2024, read the 52-character advisory even though it has no CVE. Long usernames plus cache is an auth bypass.
- Review Classic sign-on policies for "unknown user-agent" holes. Scripts and uncommon browsers were the bypass.
- Treat FastPass as phishing-resistant only on the Loopback path. The Custom-URL fallback is a different control.
Sources
- NVD: CVE-2024-7061
- Okta Trust, AD/LDAP Delegated Authentication username advisory, 1 November 2024
- Okta Trust, Classic application sign-on policy bypass, October 2024
Related identity CVEs
Related on Start with Identity
- CVEOkta Java SDK race condition crosses responses between requests
The Okta Java SDK could attach another request's response to yours (CWE-362). CVSS 8.4. Patched in v20.0.1, December 2025. Token mix-up in the official SDK.
- CVEZimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen