Penetration tests show that Okta is using an outdated jQuery library that has known vulnerabilities during Single Sign-On.

• jQuery
• Okta Identity Engine (OIE)
• Okta Classic Engine

The jQuery library used in Okta's sign-in widget has been upgraded to version 3.6.1.

This can be validated in the Chrome browser using developer tools and entering the following command in the browser developer console: 

jQueryCourage.fn.jquery

• Example:
   

There are other instances of jQuery 1.12.4 pulled from the Okta CDN (not for the sign-in widget) that security scanners will find. Upon inspection of the file, these tests reveal that, by searching for CVEs, Okta developers have left notes indicating how they addressed the vulnerability in the file.

The following error may be encountered after running this command: Uncaught ReferenceError: jQueryCourage is not defined at <anonymous>:1:1.

It happens because the Sign in widget version is using the Third-Generation widget. Temporarily disable this feature to highlight the jQuery version if needed.

Follow the steps in the Enable Third Generation Sign-In Widget documentation to toggle off the Third-generation widget.