Vulnerability · Published Dec 10, 2025 · Assigned by GitHub_M
CVE-2025-67505Race condition in the Okta Java SDK
High 8.4
In plain English
A high-severity race condition in okta-sdk-java from okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.okta.sdk:okta-sdk-root | 20.0.1 | GHSA-j5gq-897m-2rff |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| okta | okta-sdk-java | >= 11.0.0, < 20.0.1 |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L