Work at Okta? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 3 Oct 2026.
We believe community researcher participation and building a secure foundation plays an integral role in protecting our customers and their data. We appreciate all security submissions and strive to respond in an expedient manner. Okta is a cloud-based identity service that connects people to their applications from any device, anywhere, anytime. The Okta Identity Cloud provides directory services, single sign-on, strong authentication, provisioning, mobile device management and API access management. It comes with built-in reporting, and integrates deeply with cloud, mobile and on-premises applications, directories and identity management systems.
Scope
39 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| Advanced Server Access (ASA) / (ScaleFT) | website | ✓ bounty | not set |
| Advanced Server Access Client / Agents | other | ✓ bounty | not set |
| bugcrowd-pam-###.oktapreview.com | website | ✓ bounty | not set |
| bugcrowd-pam-###.pam.oktapreview.com | website | ✓ bounty | not set |
| Desktop MFA for macOS | other | ✓ bounty | not set |
Show all 39 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| Desktop MFA for Windows | other | ✓ bounty | not set |
| http://app.scaleft.com/ | website | ✓ bounty | not set |
| https://bugcrowd-pam-###-admin.oktapreview.com | website | ✓ bounty | not set |
| https://bugcrowd-pam-###.at.oktapreview.com | website | ✓ bounty | not set |
| https://bugcrowd-pam-###.oktapreview.com | website | ✓ bounty | not set |
| https://bugcrowd-pam-###.workflows.oktapreview.com | website | ✓ bounty | not set |
| Okta Agent Windows | other | ✓ bounty | not set |
| Okta Browser Plugin (IE / Firefox / Chrome) | other | ✓ bounty | not set |
| Okta On-Prem Agents ( AD, LDAP, RDP, IWA ) | other | ✓ bounty | not set |
| Okta Verify (Android) | android | ✓ bounty | not set |
| Okta Verify (iOS) | ios | ✓ bounty | not set |
| Okta Verify (Mac OS) | other | ✓ bounty | not set |
| Okta Verify (Windows) | other | ✓ bounty | not set |
| Okta Verify Fastpass | other | ✓ bounty | not set |
| Password Sync for macOS | other | ✓ bounty | not set |
| support.okta.com | website | ✓ bounty | not set |
| *.okta.com | website | out | not set |
| *.trexcloud.com | website | out | not set |
| Anything not explicitly called out above as in-scope | other | out | not set |
| AtSpoke - Entitlement bundles as a resource in access requests | website | out | not set |
| AtSpoke - Okta Workflows actions in access requests | website | out | not set |
| Backend Okta non-app infrastructure | other | out | not set |
| bugcrowd-%username%-1.oktapreview.com | website | out | not set |
| bugcrowd-%username%-2.oktapreview.com | website | out | not set |
| developer.okta.com | website | out | not set |
| https://app.scaleft.com/p/signup | website | out | not set |
| https://github.com/oktadev | website | out | not set |
| https://scaleft.com | website | out | not set |
| login.okta.com | website | out | not set |
| Network layer issues | other | out | not set |
| pages.okta.com | website | out | not set |
| personal.trexcloud.com | website | out | not set |
| trust.okta.com | website | out | not set |
| www.okta.com (static site) | website | out | not set |