Executive brief
Okta Verify is an authentication and identity verification client used by organizations to secure user access. During uninstallation with administrator privileges, the uninstaller fails to detect if the user data directory is a filesystem junction (symbolic link), causing it to recursively delete files in unintended locations on the system. A local attacker with low privileges can exploit this by creating a malicious junction to cause data loss or system damage.
Technical details
The vulnerability is classified as improper link resolution (CWE-59). The uninstaller deletes the user data directory with elevated privileges without verifying whether the directory is a filesystem junction first. When a junction is present, the delete operation follows the junction target and recursively removes unintended directory contents. The attack requires local interactive access to create filesystem junctions and precedes an administrative uninstallation action. An attacker can achieve arbitrary file deletion on the system. The vulnerability is fixed in Okta Verify for Windows version 7.0.1 and later.
Affected products
- Okta Okta Verify for Windows 5.1.3 through 6.12.3
Timeline
- 2026-09-08: disclosed