Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

Cybersecuritynews •Abinaya • September 11, 2026

Okta has released security fixes for three vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. The flaws could enable stored cross-site scripting, authorization bypass, and SQL injection in certain configurations. The vulnerabilities were disclosed on September 8, 2026. Organizations using the affected identity and access management components should prioritize upgrades, especially where Access […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Okta Patches Critical Vulnerabilities Enabling XSS, Auth Bypass, and SQL Injection Okta has issued security updates for three critical vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. These vulnerabilities, disclosed on September 8, 2026, could allow authenticated attackers to execute stored cross-site scripting (XSS), bypass Protected Rule authorization, and perform unintended SQL commands. The most severe issue, CVE-2026-85982, has a CVSS score of 9.0 and affects Auth0 AD/LDAP Connector versions prior to 8.0.0. CVE-2026-78626, with a CVSS score of 8.1, allows authorization bypass in Okta Access Gateway versions before 2026.9.1. Additionally, CVE-2026-78623 enables SQL injection through unsanitized SAML assertion values in the same Access Gateway versions. Organizations using these components should prioritize upgrading to the latest versions to mitigate risks. 6 sources 72

Extracted Entities

Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (3)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)

Vulnerabilities (1)