CVE-2025-67505 Race condition in the Okta Java SDK
Concurrent API requests in the Okta Java SDK may mix response data, potentially exposing or altering information across different user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67505?
CVE-2025-67505 is a high-severity vulnerability in okta-sdk-java, published on 10 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
Weakness: CWE-362
Which versions are affected by CVE-2025-67505?
2 open source packages ship an affected version, including com.okta.sdk:okta-sdk-root. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.okta.sdk:okta-sdk-root Maven | From 11.0.0 | 20.0.1 |
com.okta.sdk:okta-sdk-root Maven | From 11.0.0 | 20.0.1 |
Products include Okta Java Management Sdk.
How do I fix CVE-2025-67505?
Upgrade com.okta.sdk:okta-sdk-root to 20.0.1 or later.
Is CVE-2025-67505 being exploited?
There is no known exploitation of CVE-2025-67505 in the wild and no public exploit code.
Other vulnerabilities in okta-sdk-java
Sources
Also known as GHSA-j5gq-897m-2rff.