CVE-2026-78626

Analyzed Analyzed - Analysis Complete

Okta Access Gateway Authorization Bypass via Improper Input Sanitization

Publication date: 2026-09-08

Last updated on: 2026-09-22

Assigner: Okta

Description

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-22

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78626

Affected Vendors & Products

Vendor	Product	Version / Range
okta	access_gateway	to 2026.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The Okta Access Gateway has a flaw in how it checks authorization rules. When an administrator sets up a Protected Rule policy for application resources, the system fails to properly sanitize inputs and evaluate regular expressions. This allows an attacker to bypass authorization checks and gain unauthorized access.

Impact Analysis

If you use Okta Access Gateway with Protected Rule policies, an attacker could exploit this to access restricted applications or data without proper permissions. This could lead to data breaches, unauthorized actions, or further network compromise depending on the affected resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information). Organizations using Okta Access Gateway may face regulatory penalties, audit failures, or reputational damage due to insufficient access controls.

Mitigation Strategies

Review and update Protected Rule policies in Okta Access Gateway to ensure proper input sanitization and regular expression handling. Remove any administrator-configured Protected Rule policies on application resources if not absolutely necessary.

Hi! I’m here to help you understand CVE-2026-78626. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70