Okta Verify Agent for Windows Flaw Let Attackers Steal User Passwords

A newly discovered vulnerability in Okta’s Device Access features for Windows could allow attackers to steal user passwords on compromised devices.

The flaw affecting the Okta Verify agent for Windows specifically concerns how the software interacts with OktaDeviceAccessPipe, a component that handles passwordless multi-factor authentication (MFA) logins.

The flaw could enable malicious actors to retrieve credentials associated with desktop MFA passwordless logins if exploited. 

The vulnerability was uncovered during routine penetration testing, highlighting the importance of continuous security assessments for software products.

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

CVE-2024-9191 – Vulnerability Details

The vulnerability, identified as CVE-2024-9191, was published on November 1, 2024, and is classified as an Insecure Interaction Between Components leading to Information Disclosure.

It is associated with CWE-276, which refers to improper privilege management. The flaw has been given a CVSS v3 score of 7.1, indicating a high-severity risk.

The attack vector is local (AV:L), with low attack complexity (AC:L), and requires low privileges (PR:L) to exploit.

No user interaction (UI:N) is needed, and the vulnerability significantly impacts confidentiality (C:H) and integrity (I:H) but does not affect availability (A:N).

The vector string summarizing the risk is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

This vulnerability impacts customers using Okta Verify for Windows versions 5.0.2 through 5.3.2.

A critical precondition for exploitation is that the user must leverage Okta Device Access’s passwordless feature.

Customers who do not use the passwordless option or operate Okta Verify on platforms other than Windows are unaffected. Users relying on FastPass are also unaffected by this issue.

Okta Verify’s role in passwordless logins for desktop MFA has made this flaw particularly concerning for organizations prioritizing password-free authentication.

While passwordless logins increase user convenience and security, this vulnerability highlights the need for maintaining updated software to mitigate emerging threats.

To address the issue, Okta strongly recommends that all customers using vulnerable versions of Okta Verify upgrade to version 5.3.3 or later for Windows, as this update contains the necessary patch to close the security gap.

The vulnerability was introduced in version 5.0.2 and remediated in Okta Verify for Windows version 5.3.3, released for general availability (GA) on October 25, 2024.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!