CVE-2025-67505

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243	Patch
https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:*

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El SDK de gestión de Java de Okta facilita las interacciones con la API de gestión de Okta. En las versiones 11.0.0 a 20.0.0, pueden surgir condiciones de carrera a partir de solicitudes concurrentes que utilizan la clase ApiClient. Esto podría provocar que un código de estado o una cabecera de respuesta de la respuesta de una solicitud influya en la respuesta de otra solicitud. Este problema se ha corregido en la versión 20.0.1.

Information

Published : 2025-12-10 23:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-67505

Mitre link : CVE-2025-67505

CVE.ORG link : CVE-2025-67505

JSON object : View

Products Affected

okta

java_management_sdk

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2025-67505", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67505", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T15:37:59.171457Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "okta", "product": "okta-sdk-java", "versions": [{"status": "affected", "version": ">= 11.0.0, < 20.0.1"}]}]}], "published": "2025-12-10T23:15:48.667", "references": [{"url": "https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request\u2019s response to influence another request\u2019s response. This issue is fixed in version 20.0.1."}, {"lang": "es", "value": "El SDK de gesti\u00f3n de Java de Okta facilita las interacciones con la API de gesti\u00f3n de Okta. En las versiones 11.0.0 a 20.0.0, pueden surgir condiciones de carrera a partir de solicitudes concurrentes que utilizan la clase ApiClient. Esto podr\u00eda provocar que un c\u00f3digo de estado o una cabecera de respuesta de la respuesta de una solicitud influya en la respuesta de otra solicitud. Este problema se ha corregido en la versi\u00f3n 20.0.1."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62438062-BAC8-4B6C-8940-244143824FA0", "versionEndExcluding": "20.0.1", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}