---
id: CVE-2025-67505
title: Okta Java Management SDK facilitates interactions with the Okta management API
summary: >-
  Okta Java Management SDK facilitates interactions with the Okta management
  API. In versions 11.0.0 through 20.0.0, race conditions may arise from
  concurrent requests using the ApiClient class. This could cause a status code
  or response h…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L'
cwe:
  - CWE-362
vendor: okta
product: java_management_sdk
affected:
  - 'java_management_sdk >= 11.0.0, < 20.0.1'
patched:
  - java_management_sdk 20.0.1
published: '2025-12-10'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67505'
references:
  - url: >-
      https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243
    label: security-advisories@github.com
  - url: >-
      https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-j5gq-897m-2rff'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00207
epssPercentile: 0.09621
aliases:
  - GHSA-j5gq-897m-2rff
ecosystem: maven
ingestedAt: '2026-09-15T11:36:07.421Z'
---

## Overview

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

## Affected

- `java_management_sdk >= 11.0.0, < 20.0.1`

## Remediation

Upgrade past the affected range:

- `java_management_sdk 20.0.1`

## Package advisory (CVE-2025-67505)

Affected packages:

- `com.okta.sdk:okta-sdk-root >= 11.0.0, <= 20.0.0`

Patched in:

- `com.okta.sdk:okta-sdk-root 20.0.1`

Source: https://github.com/advisories/GHSA-j5gq-897m-2rff