Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546 - Oct 22, 2026
Description
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
Affected product and versions
Customers using the Okta Access Gateway versions prior to 2026.10.2 are affected.
Preconditions
A user holds a valid session for any authentication source configured on the gateway.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.
Resolution
The vulnerability is present in Okta Access Gateway versions prior to 2026.10.2 and is resolved in version 2026.10.2.
CVE details
CVE ID | CVE-2026-115546 |
Published Date | 2026-10-22 |
Vulnerability Type | Authentication Bypass |
CWE | CWE-639 (Authorization Bypass Through User-Controlled Key) CWE-287 (Improper Authentication) |
CVSS v3 | Score: 8.1 Vector string: |