Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration CVE-2026-78625 - Sep 8, 2026
Description
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.
Affected product and versions
Customers using the Okta Access Gateway versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following preconditions are present:
The Okta Access Gateway administrative management interface is network-reachable,
An authenticated user holds administrator privileges with authorization to create or modify the dashboard site configuration,
At least one dashboard site is configured with application entries that include label values.
Customer Recommendations
To remediate this vulnerability, upgrade Okta Access Gateway to version 2026.9.1 or greater.
Resolution
The vulnerability is present in Okta Access Gateway versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | Code Injection |
CWE | CWE-94 – Improper Control of Generation of Code |
CVSS v3 | Score: 6.7 Vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |