{"id":"CVE-2025-67505","aliases":["EUVD-2025-202630","GHSA-j5gq-897m-2rff"],"status":"published","title":"Race condition in the Okta Java SDK","description":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00222,"percentile":0.12943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2025-12-10T21:31:52Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Maven","package":"com.okta.sdk:okta-sdk-root","fixed_in":["20.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.okta.sdk:okta-sdk-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"20.0.0"},{"fixed":"20.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.okta.sdk:okta-sdk-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"20.0.1"}]}],"versions":["11.0.0","11.0.2","11.0.3","12.0.0","12.0.1","12.0.2","13.0.0","13.0.1","13.0.2","13.0.3","14.0.0","15.0.0","16.0.0","17.0.0","18.0.0","19.0.0","19.0.1","20.0.0"]}],"products":[{"vendor":"okta","product":"java_management_sdk"},{"vendor":"okta","product":"okta-sdk-java"}],"references":[{"url":"https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/advisories/GHSA-j5gq-897m-2rff"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67505.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67505","tags":["advisory"]},{"url":"https://github.com/okta/okta-sdk-java","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-67505","title":"Race condition in the Okta Java SDK","description":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.","status":"published","published":"2025-12-10T22:19:20.694Z","modified":"2025-12-11T15:38:07.664Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:32:52.21763Z"}],"euvd":[{"id":"EUVD-2025-202630","description":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.","status":"published","published":"2025-12-10T22:19:20Z","modified":"2025-12-11T15:38:07Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:06.661228Z"}],"ghsa":[{"id":"GHSA-j5gq-897m-2rff","title":"Race condition in the Okta Java SDK","description":"### Description\nIn the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response.\n\n\n### Affected product and versions\nYou may be affected if you meet the following preconditions:\n- Using the Okta Java SDK between versions 11.0.0 and 20.0.0, and\n- Implementing a multithreaded application with the ApiClient class where the response status code is used in access control flows\n\n### Resolution\nUpgrade Okta/okta-sdk-java to versions 21.0.0  or greater.","status":"published","published":"2025-12-10T21:31:52Z","modified":"2026-09-15T11:05:12Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:41:17.136201Z"}],"nvd":[{"id":"CVE-2025-67505","description":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.","status":"published","published":"2025-12-10T23:15:48.667Z","modified":"2026-09-25T23:10:00.463Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:11:49.861863Z"}],"osv":[{"id":"CVE-2025-67505","title":"Race condition in the Okta Java SDK","description":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.","status":"published","published":"2025-12-10T22:19:20.694Z","modified":"2026-10-28T02:30:35.889086689Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"GHSA-j5gq-897m-2rff","title":"Race condition in the Okta Java SDK","description":"### Description\nIn the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response.\n\n\n### Affected product and versions\nYou may be affected if you meet the following preconditions:\n- Using the Okta Java SDK between versions 11.0.0 and 20.0.0, and\n- Implementing a multithreaded application with the ApiClient class where the response status code is used in access control flows\n\n### Resolution\nUpgrade Okta/okta-sdk-java to versions 21.0.0  or greater.","status":"published","published":"2025-12-10T21:31:52Z","modified":"2025-12-10T21:56:16.38014Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}