# Okta support system 2023: diagnostic files can carry live account authority Canonical: https://www.web3sec.news/blog/okta-support-session-tokens Author: Raiders (https://www.web3sec.news/about) Format: postmortem Topic: Support evidence & sessions Published: 2026-11-08 Updated: 2026-11-08 Incident date: 2023-09-28 A support-system compromise links browser synchronization, service-account access and sensitive HAR files to session hijacking. ## What the vendor investigation reported Okta’s November 2023 report describes unauthorized access to customer-support files between 28 September and 17 October 2023. Some HAR files contained session tokens that were used to hijack customer sessions. The report describes a service-account credential saved into a personal browser profile and identifies compromise of the personal account or device as the most likely exposure path. Okta also documented an investigation gap: file downloads through a different interface generated different events from those initially reviewed. Its October advisory explained that HAR archives can contain credentials and session data and recommended sanitization. The article’s incident date marks the start of the reported access window; Web3Sec has not independently inspected those systems or determined current customer impact. ## A support attachment can cross a privilege boundary Our analysis: a diagnostic archive may contain the same authority as an authenticated browser session. Sending it to a support system changes who can access that authority, even if the main application never exposes its database. Classify HAR files, memory dumps, screenshots and environment captures by their possible contents, not by the assumption that troubleshooting material is harmless. Create sanitized captures using test identities where practical. Review request and response headers, cookies, URLs and bodies before sharing an analysis copy. Keep original evidence in a restricted location when an investigation requires it. Invalidate sessions or secrets included in a capture according to their actual exposure, rather than assuming that deleting the support ticket retracts all copies. ## Test the audit event, not just the visible workflow Inventory ways to access an attachment: opening a case, browsing a file list, downloading by direct link, using an API and accessing an exported archive. Use a synthetic file to verify which log event each path creates. Confirm that the investigation query includes all relevant event types and that retention, delays and pagination do not silently omit part of the timeline. Apply the same reasoning to browser synchronization and service identities. Determine whether managed credentials can enter a personal profile and whether a support account can read more cases than necessary. Remove unnecessary access and verify the denied path with a test account. Distinguish the identity that logs into the support platform from the customer session token contained in its files; both can require separate revocation. ## Practice evidence handling and customer containment Run an exercise with a deliberately invalid dummy token inside a support archive. Ask the support operator to identify sensitive content, route a restricted copy and explain how the receiving system records access. Ask the responder to reconstruct every download through the supported interfaces. Keep all materials synthetic so the exercise does not create another credential leak. For a real incident, preserve the attachment-access history, identify affected live authority, revoke it and review subsequent account actions. Communicate separately about known file access, suspected token exposure and confirmed account use. Completion is a verified chain from evidence access to customer-session containment, with explicit logging gaps and no unsupported claim that a password change alone ended every active session. ## Controls to take away - Support systems can hold live authorization material. - Different interfaces may generate different audit events. - Attachment access and downstream session use need separate investigation. ## Working checklist Assign owners and record supporting evidence in your team's system. - [ ] Classify support captures as potentially credential-bearing. - [ ] Sanitize analysis copies and restrict originals. - [ ] Verify audit events for every attachment access path. - [ ] Review browser synchronization of managed credentials. - [ ] Revoke embedded sessions and investigate their subsequent use. ## Sources & further reading - [Okta: support-system root cause and remediation, 3 November 2023](https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/) - [Okta: initial support-system advisory, 20 October 2023](https://sec.okta.com/articles/2023/10/tracking-unauthorized-access-oktas-support-system/) Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis. [Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)