CVE-2026-115546

Authentication Source Verification Issue in Okta Access Gateway

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-115547

Command Execution via Admin Console Input in Okta Access Gateway

An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78628

Improper Input Validation in the Okta Credential Provider for Windows

The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Okta Credential Provider For Windows

CVE-2026-78632

Insecure Default File Permissions in Okta RADIUS Agent Windows Installer

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Okta Radius Agent

CVE-2026-78633

Denial of Service in Okta RADIUS Agent Packet Parser

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Okta Radius Agent

CVE-2026-78545

Improper Input Sanitization in Okta Access Gateway Application Label Configuration

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78550

Improper Input Handling in Okta Access Gateway Management Console Exception Handler

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78579

Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78574

Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Hyperdrive Okta Hyperdrive Integration Plugin

CVE-2026-78560

Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78552

Validation Bypass in Okta Access Gateway Custom Directives

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78620

Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78623

Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78624

Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78625

Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78626

Improper Input Sanitization in Okta Access Gateway Protected Rules

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78627

Improper Credential Protection in Okta Hyperdrive Integration Installer Logging

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Hyperdrive Okta Hyperdrive Integration Plugin

CVE-2026-78629

Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Hyperdrive Okta Hyperdrive Agent

CVE-2026-78630

Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing

The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Access Gateway

CVE-2026-78631

Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Hyperdrive Okta Hyperdrive Agent