The vulnerability arises because the Okta Credential Provider for Windows does not validate a serialized credential buffer before parsing it as a Kerberos logon structure. As a result, malformed input can lead to out‑of‑bounds memory reads or writes, or cause the provider process to crash.

This flaw affects installations of the Okta Credential Provider for Windows that are older than version 1.4.6.0. All systems using the credential provider, typically Windows workstations or servers in enterprises that rely on Okta for authentication, are potentially impacted until the provider is updated.

The CVSS score is 6.0, indicating a medium severity vulnerability. The EPSS score is below 1 %, suggesting that exploitation is uncommon at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local because the flaw requires the ability to supply a crafted credential buffer to the provider, which is typically available only to users with the capacity to log on or inject the buffer during authentication. If an attacker can supply such a buffer, the vulnerability could result in a local information disclosure or a denial of service against the credential provider.