CVE-2026-78623

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*

History

22 Sep 2026, 20:27

Type	Values Removed	Values Added
First Time		Okta access Gateway Okta
References	~~() https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623 -~~	() https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623 - Vendor Advisory
CPE		cpe:2.3:a:okta:access_gateway::::::::

Information

Published : 2026-09-08 20:18

Updated : 2026-09-22 20:27

NVD link : CVE-2026-78623

Mitre link : CVE-2026-78623

CVE.ORG link : CVE-2026-78623

JSON object : View

Products Affected

okta

access_gateway

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-78623", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78623", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T17:52:02.307541Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@okta.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "psirt@okta.com", "affectedData": [{"vendor": "Okta", "product": "Okta Access Gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T20:18:37.050", "references": [{"url": "https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623", "tags": ["Vendor Advisory"], "source": "psirt@okta.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@okta.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database."}], "lastModified": "2026-09-22T20:27:41.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C169A22F-2C3D-40B8-B3E7-1EEEAE47D950", "versionEndExcluding": "2026.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@okta.com"}