High severity · published Dec 10, 2025
CVE-2025-67505
Race condition in the Okta Java SDK
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OK
okta-sdk-java · okta
>= 11.0.0, < 20.0.1 · source: vendor
JM
Java Management Sdk · Okta
11.0.0 before 20.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67505
Patch
https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243
Vendor Advisory
https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff
More from okta-sdk-java
5.3
CVE-2025-66033
Improper Memory Cleanup in the Okta Java SDK