psirt@okta.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS psirt@okta.com
03
assessed vulnerabilities (37)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115547US | — | — | ||
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can lever… | ||||
| CVE-2026-115546US | — | — | ||
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source par… | ||||
| CVE-2026-85473US | — | — | ||
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token pa… | ||||
| CVE-2026-78633US | — | — | ||
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, re… | ||||
| CVE-2026-78632US | — | — | ||
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent confi… | ||||
| CVE-2026-78628US | — | — | ||
The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string of… | ||||
| CVE-2026-107371US | — | — | ||
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge val… | ||||
| CVE-2026-107370US | — | — | ||
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a… | ||||
| CVE-2026-107369US | — | — | ||
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authenticat… | ||||
| CVE-2026-85983US | — | — | ||
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's config… | ||||
| CVE-2026-85982US | — | — | ||
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in t… | ||||
| CVE-2026-85981US | —OT elevated | — | ||
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local,… | ||||
| CVE-2026-84685US | — | — | ||
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) enviro… | ||||
| CVE-2026-78635US | — | — | ||
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handl… | ||||
| CVE-2026-78631US | medium5.5 | — | ||
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of se… | ||||
| CVE-2026-78630US | — | — | ||
The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local… | ||||
| CVE-2026-78629US | medium5.5 | — | ||
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains o… | ||||
| CVE-2026-78622US | — | — | ||
The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete o… | ||||
| CVE-2026-78627US | medium5.5 | — | ||
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Ap… | ||||
| CVE-2026-78626US | medium6.5OT elevated | — | ||
The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass… | ||||