CVE-2025-67505: Race condition in the Okta Java SDK

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-09-25
Weakness: CWE-362

Description

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

Affected products

okta-sdk-java: from 11.0.0 before 20.0.1 — fixed in 20.0.1

How to fix

Upgrade to a fixed version: okta-sdk-java 20.0.1. Check the vendor advisory for mitigations.

References

https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243
https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff

Get alerted when CVE-2025-67505 or the next vulnerability affects your stack