CVE-2025-67505: Race condition in the Okta Java SDK
Description In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response.
Affected product and versions You may be affected if you meet the following preconditions: - Using the Okta Java SDK between versions 11.0.0 and 20.0.0, and - Implementing a multithreaded application with the ApiClient class where the response status code is used in access control flows
Resolution Upgrade Okta/okta-sdk-java to versions 21.0.0 or greater.
Other sources
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67505?
CVE-2025-67505 has been classified as a moderate severity vulnerability due to potential race conditions.
How do I fix CVE-2025-67505?
To mitigate CVE-2025-67505, upgrade the Okta Java SDK to a version above 20.0.0.
What are the potential impacts of CVE-2025-67505?
CVE-2025-67505 can lead to incorrect responses when multiple concurrent requests are made using the ApiClient class.
Which versions of the Okta Java SDK are affected by CVE-2025-67505?
CVE-2025-67505 affects the Okta Java SDK versions between 11.0.0 and 20.0.0.
How can I determine if my application is vulnerable to CVE-2025-67505?
Check if your application uses the Okta Java SDK within the affected version range to determine vulnerability to CVE-2025-67505.