Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-115546

Authentication Source Verification Issue in Okta Access Gateway

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Okta

Description

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Okta Okta Access Gateway

Default version status: unaffected

  • 0 to < 2026.10.2affected

References