Okta Verify and Browser Plugin
CVE-2026-78622: Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Okta Verify for Windows 5.1 | 7.0.0 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.