The vulnerability in Okta Verify for Windows 5.1.3 involves the uninstaller performing deletion operations on the user data directory without checking if it is a filesystem junction (symbolic link). Because the delete operation follows the junction target, it can recursively delete files and directories outside the intended scope, potentially leading to significant data loss or disruption. The CVSS 3.1 score is 6.0, reflecting medium severity with local attack vector, high attack complexity, low privileges required, user interaction needed, and impact on integrity and availability but not confidentiality.

Exploitation can lead to unintended recursive deletion of files and directories outside the intended user data directory, causing loss of data integrity and availability. There is no impact on confidentiality. The attacker requires local access with limited privileges and user interaction to trigger the uninstaller.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the uninstaller in environments where the user data directory could be a filesystem junction pointing to critical directories. Exercise caution with filesystem junctions and symbolic links in the user data path.