Okta Device Access Vulnerability: Attackers Can Retrieve Desktop MFA Passwords
CVE-2024-9191

7.8HIGH

Key Information:

Vendor

Okta

Status
Okta Verify For Windows
Vendor
CVE Published:
1 November 2024

What is CVE-2024-9191?

A vulnerability exists in the Okta Verify agent for Windows that compromises the Device Access features. Specifically, the vulnerability allows attackers who gain access to a user's device to exploit the OktaDeviceAccessPipe, which may enable them to retrieve passwords linked to Desktop MFA passwordless logins. This issue was identified during routine penetration testing and poses risks only to users utilizing the passwordless feature of Okta Device Access. Users of Okta Verify on non-Windows platforms, as well as those exclusively utilizing FastPass, are not affected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Okta Verify for Windows 5.0.2 < 5.3.3

References

https://trust.okta.com/security-advisories/
vendor-advisory
https://help.okta.com/oie/en-us/content/topics/releasenot...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.