CVE-2025-67505CWE-362

CVE-2025-67505

High · published December 11, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in the Okta Java Management SDK could let one request's response crash into another's — it’s like ordering at a busy restaurant and accidentally getting someone else's dessert! 🍰 Imagine you're at a bustling café where multiple orders are being prepared simultaneously. If the barista isn’t careful, your cappuccino could end up topped with whipped cream meant for another customer's hot chocolate — leaving you puzzled and possibly disappointed! In this scenario, an attacker could exploit this vulnerability, leading to incorrect status codes or response headers. This could create confusion or mislead applications relying on API responses, potentially causing significant security issues or service disruptions. The consequences might not be immediately obvious, but incorrect data handling can lead to cascading failures in critical systems.

Put simply

Imagine you're at a bustling café where multiple orders are being prepared simultaneously. If the barista isn’t careful, your cappuccino could end up topped with whipped cream meant for another customer's hot chocolate — leaving you puzzled and possibly disappointed! The vulnerability arises from race conditions in the ApiClient class within the Okta Java Management SDK, where concurrent requests can interfere with one another, resulting in responses being incorrectly associated with the wrong requests.

What to do

In this scenario, an attacker could exploit this vulnerability, leading to incorrect status codes or response headers. This could create confusion or mislead applications relying on API responses, potentially causing significant security issues or service disruptions. The consequences might not be immediately obvious, but incorrect data handling can lead to cascading failures in critical systems. To mitigate this issue, update your Okta Java Management SDK to version 20.0.1 or later. Additionally, evaluate your application's handling of API responses to ensure it correctly processes them, regardless of potential race conditions. Don't forget to test thoroughly after the patch! You’ve got this! Just follow these steps, and you’ll have your systems secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2025-12-11T04:15Z
Affected products (1)
ProductVersionsFixed in
okta/java_management_sdk≥ 11.0.0, < 20.0.120.0.1
References (2)
EPSS history
Timeline
  • 10 DEC 22:19Z
    Race condition in the Okta Java SDK
    cvelistv5