Skip to content

security: Okta device token is predictable (okta_<user>_saml2aws) #23

New issue
New issue
Closed
#29
Closed
security: Okta device token is predictable (okta_<user>_saml2aws)#23
#29
Labels
nature:securityConfidentiality, integrity or credential safetyprovider:oktapkg/provider/oktaseverity:S2Common configuration broken, or a hard workaroundstatus:intakeStage 1: record openedtype:bugsaml2aws does something wrong that it is meant to do right

Description

@aspratt
aspratt
opened on Oct 20, 2026

Intake from triage theme 5 (upstream PR Versent#1484).

The Okta DT cookie is derived from the username, which weakens "remember this device". The fix is a random UUID stored per IdP URL in the keychain (credentials.SaveCredentials, the same as the session cookie).

Reproduce: a unit test asserting the token is not derivable from the username and is stable across runs.

Activity

  1. aspratt
    added
    type:bugsaml2aws does something wrong that it is meant to do right
    nature:securityConfidentiality, integrity or credential safety
    severity:S2Common configuration broken, or a hard workaround
    status:intakeStage 1: record opened
    provider:oktapkg/provider/okta
    on Oct 20, 2026

  2. aspratt commented on Oct 20, 2026

    @aspratt
    aspratt
    on Oct 20, 2026
    OwnerAuthor

    Fix in PR #29 (7ef63df): each install gets a random Okta device token, stored in the keychain. Review and e2e are in progress.

  3. aspratt commented on Oct 20, 2026

    @aspratt
    aspratt
    on Oct 20, 2026
    OwnerAuthor

    PR #29: review APPROVE, e2e and e2e-aws PASS. Ready for approval in #12, with one decision on the no-keychain fallback.

  4. aspratt
    added a commit that references this issue on Oct 20, 2026

    fix(okta): file fallback for the device token; don't rotate on transi…

    d2e7c3d
  5. aspratt
    closed this as completedin #29on Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    nature:securityConfidentiality, integrity or credential safetyprovider:oktapkg/provider/oktaseverity:S2Common configuration broken, or a hard workaroundstatus:intakeStage 1: record openedtype:bugsaml2aws does something wrong that it is meant to do right

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions