Okta Super Admin Received the Standard Okta-Provided Content for Emails instead of the Custom One during Password Reset
Feb 22, 2024
Okta Classic Engine
Okta Identity Engine
Administration
Overview
When a Super Administrator does a password reset, the Okta-provided (standard) content for emails will always be received, never the custom email template.
Applies To
- Super Administrators
- E-mail Customization
- Okta Classic Engine
- Okta Identity Engine
Solution
This was addressed as part of our Security updates that focus on admin sessions. As the custom email template can be modified, malicious code that targets Super Administrators can be injected. Since Okta considers this a security vulnerability, this has been resolved by restricting Super Admins from receiving customized emails.
Super admins are still unrestricted from editing email templates and receiving/sending test emails for customized templates.
