CVE-2026-78623

trust.okta.com • September 11, 2026

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

Affected product and versions

Customers using the Okta Access Gateway versions prior to 2026.9.1 are affected.

This applies if the following preconditions are present:

Okta Access Gateway is configured to use an advanced-mode database datastore with custom SQL queries referencing SAML assertion attributes.

An active authentication session providing the referenced SAML assertion attributes is present, with attacker-controlled values for at least one referenced attribute.

Customer Recommendations

To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.

The vulnerability is present in Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.

CWE-89 – Improper Neutralization of Special Elements used in an SQL Command

Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Download the Okta Access Gateway image

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Okta Patches Critical Vulnerabilities Enabling XSS, Auth Bypass, and SQL Injection Okta has issued security updates for three critical vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. These vulnerabilities, disclosed on September 8, 2026, could allow authenticated attackers to execute stored cross-site scripting (XSS), bypass Protected Rule authorization, and perform unintended SQL commands. The most severe issue, CVE-2026-85982, has a CVSS score of 9.0 and affects Auth0 AD/LDAP Connector versions prior to 8.0.0. CVE-2026-78626, with a CVSS score of 8.1, allows authorization bypass in Okta Access Gateway versions before 2026.9.1. Additionally, CVE-2026-78623 enables SQL injection through unsanitized SAML assertion values in the same Access Gateway versions. Organizations using these components should prioritize upgrading to the latest versions to mitigate risks. 6 sources 72

Extracted Entities

CVE-2026-78623

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)