PT-2025-50545 · Okta · Okta Java Management Sdk

Published 2025-12-10 · Updated 2025-12-12 · CVE-2025-66033

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Okta Java Management SDK versions 21.0.0 through 24.0.0

Description The Okta Java Management SDK, used for interacting with the Okta management API, has a potential issue in multithreaded implementations. Versions 21.0.0 through 24.0.0 may experience memory issues due to improper thread cleanup after requests. This can lead to performance degradation and availability issues in long-running applications, potentially resulting in a denial-of-service condition under sustained load. Applications utilizing the ApiClient in a multithreaded manner are particularly at risk.

Recommendations Update to version 24.0.1 or later.

Exploit

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2025-66033

GHSA-QHR6-6CGV-6638

Affected Products

Okta Java Management Sdk

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66033.json · Exploit
• https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638 · Vendor Advisory
• https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f · Patch
• https://osv.dev/vulnerability/CVE-2025-66033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66033 · Security Note
• https://t.me/CVEtracker/39413 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1pkvele/resumen_diario_de_vulnerabilidades_12122025 · Reddit Post
• https://twitter.com/CVEnew/status/1999108907613159688 · Twitter Post