CVE-2025-67505: Race condition in the Okta Java SDK

December 10, 2025 (updated September 15, 2026)

In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response.

References

github.com/advisories/GHSA-j5gq-897m-2rff
github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243
github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff
nvd.nist.gov/vuln/detail/CVE-2025-67505

Code Behaviors & Features

Detect and mitigate CVE-2025-67505 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →