Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Gbhackers •Divya • September 11, 2026

Okta has released security updates for three high-severity vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. These vulnerabilities could allow authenticated attackers to trigger stored cross-site scripting (XSS), bypass Protected Rule authorization controls, or execute unintended SQL commands against configured backend databases under specific deployment conditions. All three vulnerabilities were disclosed on September […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Okta Patches Critical Vulnerabilities Enabling XSS, Auth Bypass, and SQL Injection Okta has issued security updates for three critical vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. These vulnerabilities, disclosed on September 8, 2026, could allow authenticated attackers to execute stored cross-site scripting (XSS), bypass Protected Rule authorization, and perform unintended SQL commands. The most severe issue, CVE-2026-85982, has a CVSS score of 9.0 and affects Auth0 AD/LDAP Connector versions prior to 8.0.0. CVE-2026-78626, with a CVSS score of 8.1, allows authorization bypass in Okta Access Gateway versions before 2026.9.1. Additionally, CVE-2026-78623 enables SQL injection through unsanitized SAML assertion values in the same Access Gateway versions. Organizations using these components should prioritize upgrading to the latest versions to mitigate risks. 3 sources 72

Extracted Entities

Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (2)

Platforms (1)

Tools (1)

Vulnerabilities (1)