Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores CVE-2026-78623 - Sep 8, 2026
Description
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.
Affected product and versions
Customers using the Okta Access Gateway versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following preconditions are present:
Okta Access Gateway is configured to use an advanced-mode database datastore with custom SQL queries referencing SAML assertion attributes.
An active authentication session providing the referenced SAML assertion attributes is present, with attacker-controlled values for at least one referenced attribute.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.
Resolution
The vulnerability is present in Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | SQL Injection |
CWE | CWE-89 – Improper Neutralization of Special Elements used in an SQL Command |
CVSS v3 | Score: 7.7 Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L |