CVE-2024-10327: 
Okta Verify vulnerability analysis and mitigation

A vulnerability in Okta Verify for iOS (CVE-2024-10327) was discovered on October 23, 2024, affecting versions 9.25.1 (beta) and 9.27.0 (including beta). The vulnerability allows authentication to proceed regardless of the user's selection when responding to push notifications through the iOS ContextExtension feature. This security issue specifically impacts users who enrolled in Okta Verify while their organization was using Okta Classic, regardless of whether they have since upgraded to Okta Identity Engine (Okta Advisory).

The vulnerability exploits the iOS ContextExtension feature, which is one of several push mechanisms available in Okta Verify Push on iOS devices. When users interact with push notifications by long-pressing the notification banner and selecting an option, both 'Approve' and 'Deny' options result in successful authentication. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, and is classified under CWE-287 (Improper Authentication) (Okta Advisory, NVD).

The vulnerability compromises the authentication process by allowing successful authentication regardless of the user's intended response. This affects three specific scenarios: responses from a locked screen without device unlock, notifications dragged down from the home screen, and direct replies from an Apple Watch. The impact is particularly significant as it bypasses the intended security controls of the multi-factor authentication system (Security Online).

Okta has released version 9.27.2 of Okta Verify for iOS to address this vulnerability. Organizations are advised to upgrade to this version or later immediately. Additionally, Okta recommends that customers review their System Log for potentially affected users using specific search queries to identify any suspicious authentication attempts. Organizations should cross-reference IP addresses, geolocations, and ASNs against known legitimate user activity to identify potential unauthorized access (Okta Advisory).