CVE-2025-67505Okta Java SDK race condition crosses responses between requests
What broke
The Okta Java SDK had a race (CWE-362) that could return client B's API response to client A. Under load, that response can include tokens, factors, or user profile data. CVSS 8.4. Patched in v20.0.1 (December 2025).
Why it matters
This is not an Okta-service auth bypass. It is worse in a different way: the official SDK, in your JVM, mixing identity responses. Same class as Duende's token-management race. Customers will file it as "intermittent wrong user" until someone reads the advisory.
What to do
- Upgrade the Okta Java SDK to 20.0.1 or later in every service that talks to Okta.
- Load-test after the upgrade: two users, concurrent calls, assert
subnever crosses. - Review logs from December 2025 for support cases that look like session mix-up.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
- NVD: CVE-2025-67505
- Okta Java SDK 20.0.1 release notes
Related identity CVEs
Related on Start with Identity
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogMcKesson breach started with vishing against Okta SSO, then reached Salesforce and Snowflake
ShinyHunters social-engineered McKesson employees from a lookalike domain, took their Okta credentials, and used the SSO session to reach Salesforce and Snowfla
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- Comparisonokta-vs-auth0
Okta and Auth0 are owned by the same company and solve different problems. Okta is workforce identity for your employees; Auth0 is customer identity you embed i