PT-2025-50553 · Okta · Okta Java Management Sdk

Published 2025-12-10 · Updated 2025-12-12 · CVE-2025-67505

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Okta Java Management SDK versions 11.0.0 through 20.0.0

Description The Okta Java Management SDK, used for interacting with the Okta management API, is susceptible to race conditions when handling concurrent requests utilizing the ApiClient class. These race conditions can lead to a situation where the status code or response header from one request inadvertently affects another request’s response.

Recommendations Update to version 20.0.1 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-67505

GHSA-J5GQ-897M-2RFF

Affected Products

Okta Java Management Sdk

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67505.json · Exploit
• https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff · Vendor Advisory
• https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-67505 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67505 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5gq-897m-2rff · Vendor Advisory
• https://github.com/okta/okta-sdk-java · Note
• https://reddit.com/r/VulnMatter/comments/1pkvele/resumen_diario_de_vulnerabilidades_12122025 · Reddit Post
• https://t.me/CVEtracker/39421 · Telegram Post
• https://twitter.com/CVEnew/status/1999108901674139979 · Twitter Post