CVE-2025-7371
Last modified
CVE-2025-7371 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-7371?
How severe is CVE-2025-7371?
How do I fix CVE-2025-7371?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-7365A flaw was found in Keycloak. When an authenticated attacker…7.1
- CVE-2025-7366The The REHub - Price Comparison, Multi Vendor Marketplace W…7.3
- CVE-2025-7367The Strong Testimonials plugin for WordPress is vulnerable t…6.4
- CVE-2025-7368The REHub - Price Comparison, Multi Vendor Marketplace Wordp…5.3
- CVE-2025-7369The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…6.1
- CVE-2025-7370Rejected reason: Upon investigtion upstream maintainers disc…
- CVE-2025-7374The WP JobHunt plugin for WordPress, used by the JobCareer t…5.4
- CVE-2025-7375A denial-of-service (DoS) vulnerability was identified in Om…6.5
- CVE-2025-7376Windows Shortcut Following (.LNK) vulnerability in multiple …5.9
- CVE-2025-7378An improper Input Validation vulnerability allows injecting …6
- CVE-2025-7379A security bypass vulnerability allows exploitation via Reve…5.2
- CVE-2025-7380A stored Cross-Site Scripting (XSS) vulnerability exists in …4.8
Are you affected by CVE-2025-7371?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST