CVE-2024-10327
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. The ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: * When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; * When a user is presented with a notification on the home screen and drags the notification down and selects their reply; * When an Apple Watch is used to reply directly to a notification. A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceOkta Verify for iOS versions 9.25.1 and 9.27.0 contains an authentication bypass vulnerability in the iOS ContextExtension push notification handling. When users respond to push notifications (via locked screen, home screen drag-down, or Apple Watch), both approval and denial selections incorrectly allow authentication to succeed, bypassing user intent. The vulnerability only affects users who enrolled in Okta Verify while the organization was on Okta Classic, regardless of subsequent upgrades to Okta Identity Engine.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Okta Verify iOS versionOpen the iOS Settings app, locate Okta Verify in the installed apps list, and view the version information displayed under the app name. Alternatively, open the App Store, search for Okta Verify, and check the version number listed on the app's store page.Affected if The installed version is 9.25.1 or 9.27.0 specifically.
-
Determine enrollment eraVerify whether the Okta organization was using Okta Classic or Okta Identity Engine at the time the user initially enrolled in Okta Verify. This information may be available in the user's Okta admin console under authentication policies or enrollment history, or by checking with the organization's Okta administrator about their migration status at the time of enrollment.Affected if The user enrolled in Okta Verify while the organization was on Okta Classic, regardless of any subsequent upgrades to Okta Identity Engine.
-
Confirm iOS push notification usageTest the push notification authentication flow by triggering a login request that would send a push notification to the device. Observe whether the authentication completes successfully regardless of whether the user selects Approve or Deny on the lock screen, home screen notification, or Apple Watch.Affected if Authentication succeeds whether the user taps Approve or Deny in the push notification, indicating the bypass is active.
-
Identify ContextExtension presenceOn the iOS device, go to Settings > Okta Verify > About or check the app's bundle contents for the presence of a ContextExtension component used for handling push notifications. This extension is responsible for processing the user's approval or denial response.Affected if The ContextExtension is present and handles push notification responses, which is the vulnerable component.
A user is affected if they have Okta Verify for iOS versions 9.25.1 or 9.27.0 AND enrolled while their organization was on Okta Classic, and they use push notification authentication.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedOrganizations should update Okta Verify to the latest patched version once released and identify users enrolled during Okta Classic era for potential re-enrollment to ensure the secure push flow is enforced. Until patch is available, consider alternative authentication methods.
A version subsequent to 9.27.0 (contact Okta support or check help.okta.com for the exact fixed release)
- 1. Update Okta Verify for iOS from the Apple App Store to the latest available version.
- 2. Verify that the updated version includes the fix for the push notification authentication bypass.
- 3. Confirm that users who enrolled during Okta Classic era have updated their Okta Verify app.
- 4. Test the push notification flow on iOS to ensure that 'Deny' correctly rejects authentication requests.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation2.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,160.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-10327 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-10327 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data