Log in Start free

Vulnerability · Published Jul 22, 2025 · Assigned by Okta

CVE-2025-7371

Medium 6.8

In plain English

A medium-severity sensitive data in logs in Okta On-Premises Provisioning Agent from Okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.3%top 73.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.

Affected products (as reported)

VendorProductVersions
Okta Okta On-Premises Provisioning Agent 2.2.1 – before 2.3.1

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References