CVE-2024-9191

CVE-2024-9191 is a high-severity vulnerability affecting the Okta Verify agent for Windows, specifically impacting users leveraging the Okta Device Access passwordless login feature. An attacker on a compromised device can exploit the OktaDeviceAccessPipe to retrieve passwords associated with these passwordless logins. With a CVSS score of 7.8, this local vulnerability allows for high confidentiality, integrity, and availability impact with low attack complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.