Privileged Access and Advanced Server Access
CVE-2023-0093: Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due t…
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Advanced Server Access 1.13 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.