CVE-2025-67505 PUBLISHED

Race condition in the Okta Java SDK

Assigner: GitHub_M
Reserved: 08.12.2025 Published: 10.12.2025 Updated: 11.12.2025

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS Score: 8.4

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	okta
Product	okta-sdk-java
Versions	Version >= 11.0.0, < 20.0.1 is affected

References

https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff
https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243

Problem Types

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE