GitHub Advisoryadvisory · Maven

GHSA-j5gq-897m-2rff Race condition in the Okta Java SDK

HIGH Published 2025-12-10 Modified 2025-12-10 Official page ↗
Aliases
CVE-2025-67505
Ecosystem
Maven
Packages
com.okta.sdk:okta-sdk-root
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Weaknesses
CWE-362
Reviewed
2025-12-10

Affected packages

• Maven com.okta.sdk:okta-sdk-root: >= 11.0.0, < 20.0.1 → fixed in 20.0.1

Description

Description In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. Affected product and versions You may be affected if you meet the following preconditions: • Using the Okta Java SDK between versions 11.0.0 and 20.0.0, and • Implementing a multithreaded application with the ApiClient class where the response status code is used in access control flows Resolution Upgrade Okta/okta-sdk-java to versions 21.0.0 or greater.

Related

Alias · CVE (1)

  • CVE-2025-67505 Okta Java Management SDK facilitates interactions with the Okta management API. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References